Failed to create image registry with Swift storage on s390x about image-registry HOT 7 CLOSED

$ oc edit deployment image-registry -n openshift-image-registry
spec:
  template:
    containers:
    - env:
    ...
        - name: REGISTRY_OPENSHIFT_SERVER_ADDR
          value: image-registry.openshift-image-registry.svc:5000
        - name: REGISTRY_HTTP_TLS_CERTIFICATE
          value: /etc/secrets/tls.crt
        - name: REGISTRY_HTTP_TLS_KEY
          value: /etc/secrets/tls.key
         ....
               volumes:
      - name: registry-tls
        projected:
          defaultMode: 420
          sources:
          - secret:
              name: image-registry-tls
      - configMap:
          defaultMode: 420
          name: image-registry-certificates
        name: registry-certificates
      - configMap:
          defaultMode: 420
          items:
          - key: ca-bundle.crt
            path: anchors/ca-bundle.crt
          name: trusted-ca
          optional: true
        name: trusted-ca
      - name: installation-pull-secrets
        secret:
          defaultMode: 420
          items:
          - key: .dockerconfigjson
            path: config.json
          optional: true
          secretName: installation-pull-secrets
        volumeMounts:
        - mountPath: /etc/secrets
          name: registry-tls
        - mountPath: /etc/pki/ca-trust/source/anchors
          name: registry-certificates
        - mountPath: /usr/share/pki/ca-trust-source
          name: trusted-ca
        - mountPath: /var/lib/kubelet/
          name: installation-pull-secrets

$ oc exec -it image-registry-658d869cb8-jrrd2 -n openshift-image-registry -- /bin/bash
bash-4.2$ curl --verbose https://xx.xx.xx.xx:5000/v3/auth/tokens
* About to connect() to xx.xx.xx.xx port 5000 (#0)
*   Trying xx.xx.xx.xx...
* Connected to xx.xx.xx.xx (xx.xx.xx.xx) port 5000 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
* 	subject: CN=xx.xx.xx.xx
* 	start date: Jul 23 09:46:27 2020 GMT
* 	expire date: Jul 23 09:46:27 2030 GMT
* 	common name: xx.xx.xx.xx
* 	issuer: CN=xx.xx.xx.xx
* NSS error -8156 (SEC_ERROR_CA_CERT_INVALID)
* Issuer certificate is invalid.
* Closing connection 0
curl: (60) Issuer certificate is invalid.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.