Organisation Certificate Authority (CA) recognition

Context

The following documentation provides a baseline to allow beVault containers to trust your organisation's CA when establishing TLS/HTTPS connections, even when the certificates are not issued by a commonly trusted Certificate Authority (Mozilla CA root store).

Prerequisites

Retrieve the Certificate Authority public certificate in PEM format and store it in a file in the installation folder of beVault (my-ca.pem in this documentation).

Configuration

Create a script to launch the update of certificate during container startup

The following commands must be executed in the installation directory of beVault to create a common entrypoint script that refreshes the system’s Certificate Authority (CA) trust store when the container starts :

mkdir -p ./entrypoint/common
cat > ./entrypoint/common/01-update-ca-certificates.sh << 'EOF'
#!/bin/sh

update-ca-certificates
EOF
chmod +x ./entrypoint/common/01-update-ca-certificates.sh
chmod -w ./entrypoint/common/01-update-ca-certificates.sh

Adapt docker compose configuration

The following snippet shows how to adapt the docker-compose.yml file to mount the CA certificate file into each relevant container and ensure the script created in the previous step is executed during container startup :

services:
  states:
    volumes:
      # NOTE: keep other volumes already defined
      - ./entrypoint/common:/entrypoint.d
      - ./my-ca.pem:/usr/local/share/ca-certificates/my-ca.crt
  workers:
    volumes:
      # NOTE: keep other volumes already defined
      - ./entrypoint/common:/entrypoint.d
      - ./my-ca.pem:/usr/local/share/ca-certificates/my-ca.crt

  metavault:
    volumes:
      # NOTE: keep other volumes already defined
      - ./entrypoint/common:/entrypoint.d
      - ./my-ca.pem:/usr/local/share/ca-certificates/my-ca.crt