3 ms·
> 1) internal corporation services, websites and webapps. That one's straightforward. Set up a corporate CA and use it for your internal certificates. Or, oper
by jcrites 9y ago
> 1) internal corporation services, websites and webapps.
That one's straightforward. Set up a corporate CA and use it for your internal certificates. Or, operate your corporate services on your real domain name, and use real publicly-trusted certificates - whichever is easier.
- Xcelerate 9y ago> Set up a corporate CA and use it for your internal certificates. Good luck with Docker containers running any Unix software that bundles the "default" root CAs along with it.
- vetinari 9y agoClients need the CA cert in their trust store, not servers. Client get it by the act of enrolling into AD or FreeIPA domain. On the docker side (or rather on the reverse proxy that provides access to them) you are solving different problem and it does not matter whether the key/cert is provided by your internal CA or third-party one.
- ptman 9y agoJust build your own docker container based on the one you want. E.g.: FROM kanboard/kanboard:stable ADD ownca.crt /usr/local/share/ca-certificates/ownca.crt RUN /usr/sbin/update-ca-certificates
- Xcelerate 9y agoThe problem is you can't do this for every Docker image you have, particularly for a large organization. It defeats the whole point of having base images if you need "include" Dockerfiles. If Docker had a way to build from multiple base images, that might fix the issue, but I believe they removed that bug/feature a while back.
- deleted 9y ago[deleted]