2

I went through the process of adding a new CA certificate on Ubuntu (20.04), but the same steps did not work on Debian (10) in both environments, I have downloaded the custom CA certificate (via firefox about:certificate page for an untrusted certificate site) as a PEM, then I converted it to the CRT format using openssl and then I called update-ca-certificates.

Here are the steps in a Dockerfile:

FROM ubuntu:20.04
RUN apt update &&  DEBIAN_FRONTEND=noninteractive apt install -y curl openssl ca-certificates
COPY src/main/docker/nexus-custom-ca-chain.pem /root/
RUN openssl x509 -in /root/nexus-custom-ca-chain.pem -inform PEM -out /usr/local/share/ca-certificates/custom-root-ca.crt
RUN update-ca-certificates
RUN curl https://nexus-using-custom-cert.custom.org

Building this Dockerfile

docker build . --no-cache                                                                                         

would output:

Step 1/6 : FROM ubuntu:20.04
 ---> 9140108b62dc
Step 2/6 : RUN apt update &&  DEBIAN_FRONTEND=noninteractive apt install -y curl openssl ca-certificates
 ---> Running in 2fd506a9b619
[install stuff]
Processing triggers for ca-certificates (20190110ubuntu1.1) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Removing intermediate container 2fd506a9b619
 ---> 57c01aa6180d
Step 3/6 : COPY src/main/docker/nexus-custom-ca-chain.pem /root/
 ---> e0aa6a44ced1
Step 4/6 : RUN openssl x509 -in /root/nexus-custom-ca-chain.pem -inform PEM -out /usr/local/share/ca-certificates/custom-root-ca.crt
 ---> Running in 70746b6e16fe
Removing intermediate container 70746b6e16fe
 ---> de9c98488bde
Step 5/6 : RUN update-ca-certificates
 ---> Running in 1137779ed67f
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Removing intermediate container 1137779ed67f
 ---> c834167a52a3
Step 6/6 : RUN curl https://nexus-using-custom-cert.custom.org
 ---> Running in a8dc2aa55993
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0<html>

<body> stuff
</body>
</html>
100   470  100   470    0     0   1492      0 --:--:-- --:--:-- --:--:--  1487
Removing intermediate container a8dc2aa55993
 ---> 809e4e5b6ac1
Successfully built 809e4e5b6ac1

BUT, if I use debian:10 instead (no other changes to the Dockerfile):

FROM debian:10

and I rebuild the Docker image:

Building this Dockerfile

docker build . --no-cache                                                                                         

would output:

Step 1/6 : FROM debian:10
 ---> f6dcff9b59af
Step 2/6 : RUN apt update &&  DEBIAN_FRONTEND=noninteractive apt install -y curl openssl ca-certificates
 ---> Running in 15d0c69448ed
[install stuff]
Processing triggers for libc-bin (2.28-10) ...
Processing triggers for ca-certificates (20200601~deb10u1) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Removing intermediate container 15d0c69448ed
 ---> 4bcfe8b5074b
Step 3/6 : COPY src/main/docker/nexus-custom-ca-chain.pem /root/
 ---> fa53734a536a
Step 4/6 : RUN openssl x509 -in /root/nexus-custom-ca-chain.pem -inform PEM -out /usr/local/share/ca-certificates/custom-root-ca.crt
 ---> Running in b86813e50a77
Removing intermediate container b86813e50a77
 ---> 0b0e6aa67d7d
Step 5/6 : RUN update-ca-certificates
 ---> Running in c18625c31424
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Removing intermediate container c18625c31424
 ---> 559636874009
Step 6/6 : RUN curl https://nexus-using-custom-cert.custom.org
 ---> Running in fcd2e16441fd
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
The command '/bin/sh -c curl https://nexus-using-custom-cert.custom.org' returned a non-zero code: 60

So, what should I do to add a custom ca certificate to Debian 10 ? Debian update-ca-certificates documentation is pretty similar to Ubuntu doc; what's wrong ?

Thank you in advance!

2
  • few colleagues of mine have suggested that I add a chmod 644 on the cert before running update-ca-certificates : RUN chmod 644 /usr/local/share/ca-certificates/custom-root-ca.crt but that did not change a thing: Oct 9, 2020 at 12:28
  • Another colleague suggested I do not convert the format of the certificate authority chain, directly copying it to /usr/local/share/ca-certificates/ : COPY src/main/docker/nexus-custom-ca-chain.pem /usr/local/share/ca-certificates/ but that did not change the Debian situation either Oct 9, 2020 at 12:35

1 Answer 1

0

So thanks to my colleague @BrettDG, I was able to make it work under Debian as well.

TLDR : Make sure you include individually all certificates in the chain of trust, Ubuntu can be satisfied with only the intermediates, Debian will require the full chain

The website I am connecting to has the following chain of trust:

MyOrgRootCA
|-> MyOrgIntermediateCA
    |-> Website

and while I was thinking my PEM file named nexus-custom-ca-chain.pem had the full chain, well a run of:

openssl x509 -in /usr/local/share/ca-certificates/nexus-custom-ca-chain.pem -noout -text

eventually showed that I only had the site certificate and the intermediary certificate in this chain - so the root certificate was missing

Also, not sure it's a good idea to have several certs in 1 file; try to split them individually in their own file.

Here is the Dockerfile that will work on Debian AND Ubuntu

# FROM ubuntu:20:04
FROM debian:10
RUN apt update &&  DEBIAN_FRONTEND=noninteractive apt install -y curl openssl ca-certificates
COPY root.pem /usr/local/share/ca-certificates/root.pem
COPY intermediate.pem /usr/local/share/ca-certificates/intermediate.pem
RUN chmod 644 /usr/local/share/ca-certificates/root.pem /usr/local/share/ca-certificates/intermediate.pem
RUN update-ca-certificates
RUN curl https://nexus-using-custom-cert.custom.org

Lesson learned : Verify the chain of trust and provide each and every certificate along the chain

On each certificate in the chain, run the openssl x509 -noout output and look for:

MyOrgRootCA
Issuer:  C = CA, ST = Quebec, L = Montreal, O = Org, OU = tools, CN = Org ROOT CA
Subject: C = CA, ST = Quebec, L = Montreal, O = Org, OU = tools, CN = Org ROOT CA
MyOrgIntermediateCA
Issuer:  C = CA, ST = Quebec, L = Montreal, O = Org, OU = tools, CN = Org ROOT CA
Subject: C = CA, ST = Quebec, L = Montreal, O = Org, OU = tools, CN = Intermediate ROOT CA

There, if when we curl -v our website and see:

issuer: C = CA, ST = Quebec, L = Montreal, O = Org, OU = tools, CN = Intermediate ROOT CA

We know that providing the Intermediate and Root certificate, we're golden.

Useful command lines

Look in detail into your certificate:

openssl x509 -in mycert.crt -noout -text

Convert from binary (DER) format to x509 PEM (as wanted by update-ca-certificates)

openssl x509 -in mycert.crt  -inform der -outform PEM -out mycert.crt

Convert from text (PEM) format to binary (as wanted by Java Keytool)

openssl x509 -in mycert.pem -outform der -out mycert.der
2
  • 1
    Java keytool supports both PEM and binary (= OpenSSL DER) files for certificates, although before j7 (2011) it didn't handle PEM with 'comment' lines preceding the actual PEM block which some software produces, and Windows also tends to insert a 'BOM' at the beginning of text files which breaks the PEM formatting and must be removed Jan 17, 2021 at 3:13
  • yes that's correct, I checked it with JDK 11, thanks for the precision ! Feb 12, 2021 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .