diff --git a/util/confutil/container.go b/util/confutil/container.go
index 9434b8ff..609217f9 100644
--- a/util/confutil/container.go
+++ b/util/confutil/container.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path"
+	"regexp"
 
 	"github.com/pelletier/go-toml"
 	"github.com/pkg/errors"
@@ -19,6 +20,8 @@ const (
 	DefaultBuildKitConfigDir = "/etc/buildkit"
 )
 
+var reInvalidCertsDir = regexp.MustCompile(`[^a-zA-Z0-9.-]+`)
+
 // LoadConfigFiles creates a temp directory with BuildKit config and
 // registry certificates ready to be copied to a container.
 func LoadConfigFiles(bkconfig string) (map[string][]byte, error) {
@@ -60,7 +63,7 @@ func LoadConfigFiles(bkconfig string) (map[string][]byte, error) {
 			if regConf == nil {
 				continue
 			}
-			pfx := path.Join("certs", regName)
+			pfx := path.Join("certs", reInvalidCertsDir.ReplaceAllString(regName, "_"))
 			if regConf.Has("ca") {
 				regCAs := regConf.GetArray("ca").([]string)
 				if len(regCAs) > 0 {