Custom SSL certificate support

[rarkins]

Minimum support: Simple way of adding a custom certificate chain to a buildpack-based build. Ideally we can describe a single format of file that all languages/managers recognize. If not then a way we can "transform" it to a different format if some need it.

Ideal support: ability map a certificate into a container, configure it with an env variable, and it "just works".

[rarkins]

Example use case for this: there is a transparent proxy doing MITM HTTPS interception between the build machine and the internet.

[viceice]

Mounting a cert and provide env to configure already works for renovate but not for sidecar container.

See docs for current working stuff.

[rarkins]

Hoping to find a way to test it in an automated way too.

[rarkins]

Thinking a container like this for the proxy part: https://salmaan-rashid.medium.com/multi-mode-squid-proxy-container-running-ssl-bump-622128b8482a and bound to port 3128

And then maybe a DIND container for building the Dockerfile with an iptables rule to route ports 80 and 443 via port 3128

[viceice]

yeah, will look into it.

[rarkins]

• Run update-ca-certificates if /usr/local/share/ca-certificates/ contains any *.crt #53 - Run update-ca-certificates automatically
• Automatically configure Node.js for custom certificates #61 - Automatically configure Node.js for custom certs

[rarkins]

@viceice can you help me understand what's supported and not supported currently? e.g. is it just sidecar containers where it doesn't work?

[viceice]

yes, global and install mode should work, but certs are not passed to sidecar containers. but there is a workaround, need to search the renovate discussion

[rarkins]

How about Java? It looks like we might need to make use of Java's keytool

[rarkins]

This is a long tutorial: https://www.tutorialworks.com/java-trust-ssl/

keytool -import -alias CHOOSE-AN-ALIAS \
    -file certificate.pem \
    -keystore /path/to/your/truststore

And on ubuntu the keystore appears to be at /etc/ssl/certs/java/cacerts

[viceice]

We are using the adoptium jdk, so the store needs to be at

<installDir>/lib/security/cacerts

which is currently at /usr/local/java/<version> but will soon change to /opt/buildpack/tools/java/<version> when converted to v2 tool

version is like 8.0.342+7 and 11.0.16+8

• Cacerts lost during upgrade adoptium/adoptium-support#236

[viceice]

we can try to add all certs from /usr/local/share/ca-certificates/ when installing java, so the customer needs to follow the build-time¹ docs

Footnotes

1. https://github.com/containerbase/buildpack/blob/main/docs/custom-root-ca.md#buildtime-install ↩