Importing a self-signed certificate into the Docker JRE cacert is not recognized by the service

Question

• The Java Service runs inside the Docker container, which accesses the external HTTPS URL, and its self-launch certificate is not available for the cacert / JRE service repository, and therefore the connection fails.
• Thus, the imported self-signed certificate of the external HTTPS URL into the Docker container of the jre cacert container. (after checking the $ JAVA_HOME variable)
• Reboot the Docker container (using the docker reload command), hoping the service will also reboot and select the changes from the JRE cacert. But this did not happen, the Java service still cannot access the external HTTPS URL.

Any idea how a Java service running inside a Docker container selects JRE cacert changes with a new certificate import?

Answer 1

Therefore, the imported self-signed certificate of the external HTTPS URL into the Docker container of the JRE cacert container.

No: you need to import it into the Docker image from which you start your container.

Importing into a container will only create a temporary writable data layer that will be discarded when you reboot your container.

Something like this answer :

USER root COPY ldap.cer $JAVA_HOME/jre/lib/security RUN \ cd $JAVA_HOME/jre/lib/security \ && keytool -keystore cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias ldapcert -file ldap.cer 

Answer 2

To use already configured java containers, such as jenkins, sonarqube or nexus (for example, if you run your own build server), it is more convenient for me to mount the appropriate cacerts file in these containers with the option to launch docker.

I use the cacerts from openjdk as a base:

• extracting cacerts from an openjdk image using a temporary container:

 docker pull openjdk:latest docker run --rm --entrypoint cat openjdk:latest /etc/ssl/certs/java/cacerts > cacerts 

2. adding a certificate to the extracted cacerts using a temporary container launched from the same folder that also contains ldap.cer :

 docker run --rm -v `pwd`:/tmp/certs openjdk:latest bash -c 'cd /tmp/certs && keytool -keystore cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias buenting-root -file ldap.cer' 

3. run the target docker (s) container mounting the extracted cacerts with the run, e parameter. d. for sonarqube :

 docker run ... -v /path/to/your/prepared/cacerts:/etc/ssl/certs/java/cacerts:ro ... sonarqube:lts 

If there is a new version of openjdk, you can update the cacerts file on the host with commands from 1. and 2.

To update the target image (e.g. sonarqube ) you do not need to create your own image using the Dockerfile and docker build .