Organisation Certificate Authority (CA) recognition

Context

The following documentation provides a baseline to allow beVault containers to trust your organisation's CA when establishing TLS/HTTPS connections, even when the certificates are not issued by a commonly trusted Certificate Authority (Mozilla CA root store).

Prerequisites

Retrieve the Certificate Authority public certificate in PEM format and store it in a file in the installation folder of beVault (my-ca.pem in this documentation).

Configuration

The following snippet shows how to adapt the docker-compose.yml file to mount the CA certificate file into each container and configure the operating system's certificate store :

YAML

services:
  states:
    entrypoint:
      - "/bin/sh"
      - "-c"
      - "update-ca-certificates && exec dotnet dFakto.States.dll"
    volumes:
      # NOTE: keep other volumes already defined
      - ./my-ca.pem:/usr/local/share/ca-certificates/my-ca.crt
  workers:
    entrypoint:
      - "/bin/sh"
      - "-c"
      - "update-ca-certificates && exec dotnet dFakto.States.Workers.dll"
    volumes:
      # NOTE: keep other volumes already defined
      - ./my-ca.pem:/usr/local/share/ca-certificates/my-ca.crt

  metavault:
    entrypoint:
      - "/bin/sh"
      - "-c"
      - "update-ca-certificates && exec dotnet dFakto.DataVault2.Api.dll"
    volumes:
      # NOTE: keep other volumes already defined
      - ./my-ca.pem:/usr/local/share/ca-certificates/my-ca.crt

Note that the file is mounted with a .crt extension. This is required by update-ca-certificates, which only processes files with a .crt extension in the /usr/local/share/ca-certificates/ directory