grouper-study

[Liam Hoekenga <>]

What about dropping it in /etc/pki/ca-trust/source/anchors and using update-ca-trust to regenerate the various CA bundles?

Then use resulting copy of /etc/pki/ca-trust/extracted/java/cacerts in java?  (either overwrite /opt/java/jre/lib/security/cacerts, or add javax.net.ssl.trustStore when starting up tomcat)

Liam

On Wed, Jul 11, 2018 at 3:14 PM, John Gasper <> wrote:

Hi Liam,

 

I’d argue if you are adding them at runtime, you could/should just include them as Docker Config/bind mount/k8 configmap instead of doing it in the container start-up. Otherwise add them to the image, if those CA certs are shared across env:

 

RUN /usr/lib/jvm/zulu-8/bin/keytool -import -alias ourCA -keystore /usr/lib/jvm/zulu-8/jre/lib/security/cacerts -file /cacert.der -storepass changeit -noprompt

 

John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef

 

From: <> on behalf of Liam Hoekenga <>
Date: Wednesday, July 11, 2018 at 12:42 PM
To: <>
Subject: managing java CA keystore in a container?

 

Does anyone have any pointers on adding custom CA certificates to the java cacerts keystore inside of a container?

 

Liam