How to install a trusted certificate in a Docker container

This document describes the process of installing a certificate inside a Docker container’s trusted root certificate store.

1. The first step is to load the .crt file into the container’s file system. Have in mind that .crt is the public part of an SSL certificate. You should never store sensitive information, secrets and passwords alike, in a container or in a source control repository.
2. Add the .crt file in the same folder as your Dockerfile
3. Make sure the .crt file is included in your build’s output directory (e.g., the ‘bin’ folder). In Visual Studio, you can do this by right-clicking the file and enabling the “Copy to Output Directory” property.
4. Add these lines to the bottom of your Dockerfile but before the ENTRYPOINT.
   1. COPY my-cert.crt usr/local/share/ca-certificates/my-cert.crt
   2. RUN chmod 644 /usr/local/share/ca-certificates/my-cert.crt && update-ca-certificates
5. The COPY statement adds the certificate to the container’s trusted root certificate store which is located in usr/local/share/ca-certificates. If the certificate is not copied or if you get a “file not found” error, make sure the source path is relative to your application’s build context and the target path to the WORKDIR.
6. The RUN statement gives read and write access to the owner in the file and updates the trusted certificates.
7. Confirm the certificate was successfully installed by inspecting the etc/ssl/certs folder inside of the container. Your certificate should appear here with a .pem extension.

And that’s it! That’s all you should need to install a trusted certificate. You can test if the certificate was configured correctly by curling the target server:

curl --verbose https://<host>:<port>

If the connection is successful and verified by the root certificate, you should see a “ssl certificate verify ok” message in the response.