Certificate Authority Custom - Revision history

Busk at 15:31, 22 February 2024

2024-02-22T15:31:49Z

Busk at 00:07, 6 December 2023

2023-12-06T00:07:31Z

Busk at 23:42, 5 December 2023

2023-12-05T23:42:17Z

Busk at 23:18, 5 December 2023

2023-12-05T23:18:19Z

Busk at 23:17, 5 December 2023

2023-12-05T23:17:54Z

Busk at 22:55, 5 December 2023

2023-12-05T22:55:23Z

Busk at 22:53, 5 December 2023

2023-12-05T22:53:42Z

Busk: Created page with "# Debian ``` curl https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites -o /etc/ssl/certs/ca-certificates.crt ``` Then mount the volume..."

2023-12-05T20:58:27Z

Created page with "# Debian ``` curl https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites -o /etc/ssl/certs/ca-certificates.crt ``` Then mount the volume..."

New page

# Debian
```
curl https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites -o /etc/ssl/certs/ca-certificates.crt

```

Then mount the volume to

/etc/ssl/certs/ca-certificates.crt

extraVolumeMounts: []
extraVolumes: []

/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

← Older revision		Revision as of 15:31, 22 February 2024
Line 100:		Line 100:
	Note that fedora based is in this folder		Note that fedora based is in this folder
	/etc/pki/ca-trust		/etc/pki/ca-trust
		+
		+
		+	# Or update entire trust
		+
		+	https://stackoverflow.com/questions/38968414/kubernetes-add-ca-certificate-to-pods-trust-root
		+	```
		+	rootCA1="-----BEGIN CERTIFICATE-----
		+	MIIEYzCCA0ugA ...
		+	-----END CERTIFICATE-----
		+	all my root certs ...
		+	"
		+
		+	mkdir -p myhost-files
		+	curl https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites -o myhost-files/ca-certificates.crt
		+	echo "$rootCA1" >> myhost-files/ca-certificates.crt
		+	kubectl create configmap myhost-files --from-file=myhost-files --save-config --dry-run=client -o yaml \| kubectl apply -f -
		+	Update helm chart values.yaml
		+
		+	extraVolumeMounts:
		+	- mountPath: /etc/ssl/certs/ca-certificates.crt
		+	subPath: ca-certificates.crt
		+	name: myhost-files
		+	# extraVolumes: []
		+	extraVolumes:
		+	- name: myhost-files
		+	configMap:
		+	name: host-files
		+	See other answers for simple deploy mount.
		+
		+	Note that Fedora/RHEL based is in this folder /etc/pki/ca-trust
		+
		+	Some Functions you can expand as well for Debian/Fedora is you want to update it with additional files. I can't remember if root ca trust gets blown away on apt upgrade, probably on updates but not sure.
		+
		+	add_ca_crt_debian(){
		+	sudo apt-get install -y ca-certificates # This pkg is usually installed
		+	echo "debian"
		+	echo "${old_root_ca_crt}" \| sudo tee /usr/local/share/ca-certificates/${old_cert_file_name}
		+	echo "${root_ca_crt}" \| sudo tee /usr/local/share/ca-certificates/${cert_file_name}
		+	sudo update-ca-certificates
		+	}
		+
		+	add_ca_crt_fedora(){
		+	echo "fedora"
		+	echo "${old_root_ca_crt}" \| sudo tee /etc/pki/ca-trust/source/anchors/${old_cert_file_name}
		+	echo "${root_ca_crt}" \| sudo tee /etc/pki/ca-trust/source/anchors/${cert_file_name}
		+	sudo update-ca-trust
		+	}
		+	```

@@ Line 91: / Line 91: @@
          configMap:
            name: host-files
 ```
 Note that fedora based is in this folder
 /etc/pki/ca-trust

← Older revision		Revision as of 23:42, 5 December 2023
Line 59:		Line 59:
	$rootCa = Get-ChildItem -Path cert:\LocalMachine\My \| Where-Object {$_.Subject -eq "CN=My Awesome Root CA"}		$rootCa = Get-ChildItem -Path cert:\LocalMachine\My \| Where-Object {$_.Subject -eq "CN=My Awesome Root CA"}
	```		```
		+
		+
		+
		+	# more
		+
		+	You could update entire entire trusted CA by doing something like
		+	```
		+	internalRootCAs="-----BEGIN CERTIFICATE-----
		+	MIIEYzCCA0ugA ...
		+	-----END CERTIFICATE-----
		+	all my root certs ...
		+	```
		+
		+	```
		+	mkdir -p myhost-files
		+	curl https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites -o myhost-files/ca-certificates.crt
		+	echo "$internalRootCAs" >> myhost-files/ca-certificates.crt
		+	kubectl create configmap myhost-files --from-file=myhost-files --save-config --dry-run=client -o yaml \| kubectl apply -f -
		+	```
		+
		+
		+	Update helm chart values.yaml
		+	```
		+	extraVolumeMounts:
		+	- mountPath: /etc/ssl/certs/ca-certificates.crt
		+	subPath: ca-certificates.crt
		+	name: myhost-files
		+	# extraVolumes: []
		+	extraVolumes:
		+	- name: myhost-files
		+	configMap:
		+	name: host-files
		+	```
		+
		+	Note that fedora based is in this folder
		+	/etc/pki/ca-trust

@@ Line 1: / Line 1: @@
 # Debian
-##
+## Wipe your existing
 Wipe your existing
 ```
 curl https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites -o /etc/ssl/certs/ca-certificates.crt

@@ Line 24: / Line 24: @@
 $sst = ( Get-ChildItem roots.sst )
 $sst| Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
 ```

← Older revision		Revision as of 22:53, 5 December 2023
Line 14:		Line 14:

	/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem		/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
		+
		+
		+
		+	# Windows
		+	```
		+	cd c:\certs\
		+	certutil.exe -generateSSTFromWU roots.sst
		+	$sst = ( Get-ChildItem -Path C:\certs\roots.sst )
		+	$sst = ( Get-ChildItem roots.sst )
		+	$sst\| Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
		+	```