Setting Up Custom Trusted Certificates
Last updated
Was this helpful?
1.2
Last updated
Was this helpful?
When working with some features of the Grey Matter Proxy, notably the , it may become necessary to update the OS level trusted certificates with customer provided certs. This document shows briefly how to accomplish this.
Normally, the OS manages trusted certificates that tools like the browser, curl, etc use. These managed trusted certificates are provided by reliable third-party companies like Verisign and Cloudflare. Over time, as certificates expire or update, re-running OS tools like update-ca-certificates will fetch the most recent certs for known entities like google.com, amazon.com, etc.
When a customer uses self-signed certificates, they may not be using one of these third-party companies for validation. In this case, the browser and curl won't trust that they are who they say they are, unless we explicitly tell them to using the methods outlined here.
To configure new trusted certificates, we'll need to pull the existing docker image and re-build it with any added certs to trust. This can't easily be done just by mounting certs at runtime, as it would also require overriding the default command. (possible to do, just not very clean)
Note: the docs here assume the container is running Alpine Linux, but similar procedures can be found for Ubuntu, CentOS, etc.
Warning: Each certificate loaded must be in separate file. Any file with multiple certs will cause the procedure to fail.
Setup a local directory with any certs that need to be trusted.
For demo purposes here, this directory is called ./certs-override
Insert certs into that directly, one cert at a time. E.g.
trust1.pem, trust2.pem, trust3.pem, etc
Build the new image with the command docker build -t test/gm-proxy -f Dockerfile .. This will:
Pull an existing proxy build
Mount in the local certs
Run the OS update command
Setup the correct default runtime command
The resulting image can be run exactly the same as any other gm-proxy image, but operations will now trust the mounted certs as well.