Relution Signet Customer Hub

CA certificate in Docker

To connect services using a self-signed or internal TLS certificate, the corresponding root or intermediate CA must be registered as trusted so that Relution treats the connection as trusted. Depending on the Relution version, different methods apply.

Adding certificates via the user interface

New in 26.4

Starting with version 26.4, the Relution Docker image is based on Ubuntu instead of AlmaLinux. As a result, the path /etc/pki/ca-trust/source/anchors/ no longer exists inside the container, so a copy script relying on that path fails. From Relution 26.4 onward, CA certificates are therefore added through the user interface instead — which also allows the configuration to be adjusted while the system is running.

The required steps are:

  • Any existing prerun script (the RELUTION_PRERUN_SCRIPT environment variable in compose.yaml, or in docker-compose.yml for older installations) is removed from the configuration, after which the Relution container is restarted.
  • Sign-in takes place in the global organization.
  • Under Settings → Certificates, the desired CA certificates are uploaded (see Certificate Management →).
  • Under Settings → TLS Trust configuration → Trusted certificates, the uploaded CA certificates are selected from the certificate library via Add, and the configuration is then applied with Save.

Only CA certificates that were uploaded as a single certificate (for example in PEM, DER or CRT format) are available for selection. Server certificates without the CA flag and PKCS#12 files (.p12, .pfx) do not appear in the selection. Further details on this page are available under TLS Trust Configuration →.

The stored CA certificates apply in addition to the system’s default truststore for outgoing TLS connections of the Relution server. The trust store of the container operating system is not modified, so tools inside the container (for example curl) still do not trust the CA. The certificates are only loaded at the end of the server startup; for connections that are already established during startup (for example to an S3 object storage), see S3: Startup fails with PKIX error →.

Script-based approach (before Relution 26.4)

Show instructions

On Relution versions before 26.4 — with a Docker image based on AlmaLinux — a certificate can be loaded into the container via a prerun script as described below. In the example, a subdirectory selfsigned has been created in the directory where the docker-compose.yml was placed, containing the certificate and the associated script. A file with the following content must be created in this folder. In the example, the file is named trust_selfsigned.sh. The certificate to be copied has the file name CAcert.pem.

In addition, an upcoming move to a rootless container will generally remove the ability to install certificates via the CLI afterwards.

Running the prerun script on a Docker image from Relution 26.4 onward produces the following error:

INFO: Source pre-run script from /opt/selfsigned/trust_selfsigned.sh
cp: cannot create regular file '/etc/pki/ca-trust/source/anchors/': No such file or directory

Script 

#!/bin/bash

cp /opt/selfsigned/CAcert.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust
echo "Self-signed CA certificate has been added to OS trust store"

Next, in docker-compose.yml the script and the certificate must be mounted.

Mount script and certificate 

services:
  relution:
    environment:
      ...
      - RELUTION_PRERUN_SCRIPT=/opt/selfsigned/trust_selfsigned.sh
    ...
    volumes:
      - './application.yml:/opt/relution/application.yml'
      - './selfsigned:/opt/selfsigned'

Output of the curl

The function can be tested with a CURL.

[root@d4b846425890 relution]# curl -I https://selfsigned.server.relution.io
HTTP/1.1 302 Found
Date: Tue, 21 Sep 2021 12:37:10 GMT
Server: Apache/2.4.38
Location: https://selfsigned.server.relution.io/portal/
Content-Type: text/html; charset=iso-8859-1