grouper-study

["Coleman, Erik C" <>]

As FYI, we chose to RUN the keytool to import CA keys in our Dockerfile, just as John describes, it seemed to be the easiest approach.  Other alternatives we considered: ADD  a ourCA.jks file to the image and then referencie that with CATALINA_OPTS startup option, or inject a replacement cacerts file. Both of those required extra steps outside of the Docker build, so we opted for the previous.

 

-Erik

 

 

From: <> On Behalf Of John Gasper
Sent: Wednesday, July 11, 2018 3:15 PM
To: Liam Hoekenga <>;
Subject: Re: managing java CA keystore in a container?

 

Hi Liam,

 

I’d argue if you are adding them at runtime, you could/should just include them as Docker Config/bind mount/k8 configmap instead of doing it in the container start-up. Otherwise add them to the image, if those CA certs are shared across env:

 

RUN /usr/lib/jvm/zulu-8/bin/keytool -import -alias ourCA -keystore /usr/lib/jvm/zulu-8/jre/lib/security/cacerts -file /cacert.der -storepass changeit -noprompt

 

John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef

 

From: <> on behalf of Liam Hoekenga <>
Date: Wednesday, July 11, 2018 at 12:42 PM
To: <>
Subject: managing java CA keystore in a container?

 

Does anyone have any pointers on adding custom CA certificates to the java cacerts keystore inside of a container?

 

Liam