Relution Signet Customer Hub

CA certificate in Docker

To connect services using a self-signed or internal TLS certificate, the corresponding root or intermediate CA must be added to the trust store of the Relution container so the connection is treated as trusted. Depending on the Relution version, different methods apply.

Adding certificates via the user interface

New in 26.4

Starting with version 26.4, the Relution Docker image is based on Ubuntu instead of AlmaLinux. As a result, the path /etc/pki/ca-trust/source/anchors/ no longer exists inside the container, so a copy script relying on that path fails. From Relution 26.4 onward, CA certificates are therefore added through the user interface instead — which also allows the configuration to be adjusted while the system is running.

The required steps are:

  • Any existing prerun script (the RELUTION_PRERUN_SCRIPT environment variable in docker-compose.yml) is removed from the configuration, after which the Relution container is restarted.
  • Sign in to the global organization.
  • Under Settings → Certificates, the desired CA certificates are uploaded (see Certificate management →).
  • Under Settings → TLS Trust configuration → Trusted certificates, the uploaded CA certificates are selected from the certificate library via Add certificate.

Script-based approach (before Relution 26.4)

Show instructions

In addition, an upcoming move to a rootless container will generally remove the ability to install certificates via the CLI afterwards.

On Relution versions before 26.4 — with a Docker image based on AlmaLinux — a certificate can be loaded into the container via a prerun script as described below. In the example, a subdirectory selfsigned has been created in the directory where the docker-compose.yml was placed, containing the certificate and the associated script. A file with the following content must be created in this folder. In the example, the file is named trust_selfsigned.sh. The certificate to be copied has the file name CAcert.pem.

Running the prerun script on a Docker image from Relution 26.4 onward produces the following error:

INFO: Source pre-run script from /opt/relution/selfsigned/trust_selfsigned.sh
cp: cannot create regular file '/etc/pki/ca-trust/source/anchors/': No such file or directory

Script 

# !/bin/bash

cp /opt/selfsigned/CAcert.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust
echo "Self-signed CA certificate has been added to OS trust store"

Next, in docker-compose.yml the script and the certificate must be mounted.

Mount script and certificate 

services:
  relution:
    environment:
      ...
      - RELUTION_PRERUN_SCRIPT=/opt/selfsigned/trust_selfsigned.sh
    ...
    volumes:
      - './application.yml:/opt/relution/application.yml'
      - './selfsigned:/opt/selfsigned'

Output of the curl

The function can be tested with a CURL.

[root@d4b846425890 relution]# curl -I https://selfsigned.server.relution.io
HTTP/1.1 302 Found
Date: Tue, 21 Sep 2021 12:37:10 GMT
Server: Apache/2.4.38 (Univention)
Location: https://selfsigned.server.relution.io/portal/
Content-Type: text/html; charset=iso-8859-1