How to integrate a self signed root ca certificate into docker/sdk?

andreas.fluer
andreas.fluer Spryker Customer Posts: 8 🧑🏻‍🚀 - Cadet
in Spryker Development

Our network security has activated SSL-Decryption in our company. As a result I neet to add a self signed root ca certificate into docker/sdk.

I have no idea how to do this without manipulating all generated docker files.

What I want is to add these commands to basically all containers:

COPY config/certs/my-company-ca.crt /usr/local/share/ca-certificates/my-company-ca.crt
RUN update-ca-certificates

Can anyone guide me how I can integrate these commands into my deploy.dev.yaml so that I can download images, composer packages and node_modules using our custom root ca?

Answers

  • fsmeier
    fsmeier Senior Software Engineer & Developer Enablement Advocate Sprykee Posts: 1,113 ⚖️ - Guardians (admin)

    Heyhey @andreas.fluer ,

    do you require to add your own signed ca or can you use the one from docker-sdk?

    If the latter, have you seen https://docs.spryker.com/docs/dg/dev/set-up-spryker-locally/configure-after-installing/set-up-a-self-signed-ssl-certificate.html already? If its about having your own self-signed root cert you may please create a support ticket and provide me the issue number.

    All the best,

    Florian

  • andreas.fluer
    andreas.fluer Spryker Customer Posts: 8 🧑🏻‍🚀 - Cadet
    edited April 24

    Hey @fsmeier

    thanks for the quick response. Here is my case number: 66333

    The issue is not setting up a self signed ssl certificate, but to get a ROOT CA Certificat into my docker images/containers/volumes etc, so the SSL-Verification succeeds when downloading docker images and resources during the build process .

    BR Andreas

  • fsmeier
    fsmeier Senior Software Engineer & Developer Enablement Advocate Sprykee Posts: 1,113 ⚖️ - Guardians (admin)

    Heyhey @andreas.fluer ,

    it seems that having an own root certificate is currently not supported by the docker-sdk. With the support ticket you created I added some context for the internal teams to gain some prio.

    In the meantime, after looking into docker-sdk, I suggest to locally override the default.crt and default.key in docker/generator/openssl and run docker/sdk bootstrap deploy.dev.yml again. Based on the logic in docker/generator/openssl/generate.sh it should likely copy your certificates into the containers. - I have NOT tested it by myself yet since I am currently working on sth else.

    Hope this unblocks you at least.

    All the best,

    Florian

  • andreas.fluer
    andreas.fluer Spryker Customer Posts: 8 🧑🏻‍🚀 - Cadet

    Hi @fsmeier,

    Thanks for the information, unfortunately your proposed workaround does not work for me, as I have only the public certificate and no key. After adding only the crt and running the bootstrap and build once more, I still have the SSL-Verification errors.

    Do you have any information about the rough timeline for the official support on this?
    I'm not looking for a exact date only for a rough estimation (Q3 2025, 2026, later) to decide how to proceed.

    BR Andreas

  • fsmeier
    fsmeier Senior Software Engineer & Developer Enablement Advocate Sprykee Posts: 1,113 ⚖️ - Guardians (admin)

    hmm ok :/

    I dont have any estimation, sorry. Its with the product team to decide. But I also contacted our docker-sdk expert to think about possible solutions together. I'll keep you updated (and you will be updated via the support case anyway).

    All the best,

    Florian

Categories