docker - 将 Let's Encrypt 证书添加到 debian :9 docker image

Question

我想基于 debian:9 构建图像并添加让我们从以下链接加密证书:

https://letsencrypt.org/certs/isrgrootx1.pem.txt

https://letsencrypt.org/certs/trustid-x3-root.pem.txt

Afaik，这些应该转换为 .crt格式所以我运行:

▶ openssl x509 -in isrgrootx1.pem -inform PEM -out isrgrootx1.crt
▶ openssl x509 -in trustid-x3-root.pem -inform PEM -out trustid-x3-root.crt

然后我使用以下 Dockerfile 构建图像

FROM debian:9

RUN mkdir -p /usr/share/ca-certificates/extra


RUN apt-get update && apt-get install ca-certificates -y --no-install-recommends

COPY isrgrootx1.crt /usr/share/ca-certificates/extra/isrgrootx1.crt
COPY trustid-x3-root.crt /usr/share/ca-certificates/extra/trustid-x3-root.crt

RUN update-ca-certificates

但是，在构建结束时，我看到没有添加额外的证书:

Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.

使用 this 将它们列在正在运行的容器中时更重要的是命令

awk -v cmd='openssl x509 -noout -subject' '
    /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt

我没有看到任何 Let's Encrypt安装的证书。

我错过了任何步骤吗？

Answer 1

我相信你想要的路径是/usr/local/share/ca-certificates .以下显示添加了 2 个证书:

FROM debian:9

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates \
      openssl \
 && mkdir -p /usr/local/share/ca-certificates

ADD https://letsencrypt.org/certs/isrgrootx1.pem.txt /usr/local/share/ca-certificates/isrgrootx1.pem
ADD https://letsencrypt.org/certs/trustid-x3-root.pem.txt /usr/local/share/ca-certificates/trustid-x3-root.pem

RUN cd /usr/local/share/ca-certificates \
 && openssl x509 -in isrgrootx1.pem -inform PEM -out isrgrootx1.crt \
 && openssl x509 -in trustid-x3-root.pem -inform PEM -out trustid-x3-root.crt \
 && update-ca-certificates

请注意，您下载的证书没有说让我们在主题中加密:

root@4544afdd06e3:/# openssl x509 -noout -subject </usr/local/share/ca-certificates/isrgrootx1.pem
subject=C = US, O = Internet Security Research Group, CN = ISRG Root X1
root@4544afdd06e3:/# openssl x509 -noout -subject </usr/local/share/ca-certificates/trustid-x3-root.pem
subject=O = Digital Signature Trust Co., CN = DST Root CA X3