CODEWITHSUNDEEP
dockersslopensslssl-certificatelets-encrypt
pkaramol
pkaramol

Reputation: 19352

Adding Let's Encrypt certificates to debian:9 docker image

I want to build an image based on debian:9 and add let's encrypt certificates from the following links:

https://letsencrypt.org/certs/isrgrootx1.pem.txt

https://letsencrypt.org/certs/trustid-x3-root.pem.txt

Afaik, these should be converted to .crt format so I run:

▶ openssl x509 -in isrgrootx1.pem -inform PEM -out isrgrootx1.crt
▶ openssl x509 -in trustid-x3-root.pem -inform PEM -out trustid-x3-root.crt

Then I build an image using the following Dockerfile

FROM debian:9

RUN mkdir -p /usr/share/ca-certificates/extra


RUN apt-get update && apt-get install ca-certificates -y --no-install-recommends

COPY isrgrootx1.crt /usr/share/ca-certificates/extra/isrgrootx1.crt
COPY trustid-x3-root.crt /usr/share/ca-certificates/extra/trustid-x3-root.crt

RUN update-ca-certificates

however, at the end of the build I see no extra certificates are added:

Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.

What is more when listing them inside a running container using this command

awk -v cmd='openssl x509 -noout -subject' '
    /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt

I don't see any Let's Encrypt certificates installed.

Am I missing any step?

Upvotes: 1

Views: 2496

Answers (1)

BMitch
BMitch

Reputation: 263956

I believe the path you want is /usr/local/share/ca-certificates. The following showed 2 certificates being added:

FROM debian:9

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates \
      openssl \
 && mkdir -p /usr/local/share/ca-certificates

ADD https://letsencrypt.org/certs/isrgrootx1.pem.txt /usr/local/share/ca-certificates/isrgrootx1.pem
ADD https://letsencrypt.org/certs/trustid-x3-root.pem.txt /usr/local/share/ca-certificates/trustid-x3-root.pem

RUN cd /usr/local/share/ca-certificates \
 && openssl x509 -in isrgrootx1.pem -inform PEM -out isrgrootx1.crt \
 && openssl x509 -in trustid-x3-root.pem -inform PEM -out trustid-x3-root.crt \
 && update-ca-certificates

Note, the certificates you downloaded do not say lets encrypt in the subject:

root@4544afdd06e3:/# openssl x509 -noout -subject </usr/local/share/ca-certificates/isrgrootx1.pem
subject=C = US, O = Internet Security Research Group, CN = ISRG Root X1
root@4544afdd06e3:/# openssl x509 -noout -subject </usr/local/share/ca-certificates/trustid-x3-root.pem
subject=O = Digital Signature Trust Co., CN = DST Root CA X3

Upvotes: 2

Related Questions