Skip to content

fix: enhance CA certificate handling in entrypoint script #40933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pratapaprasanna merged 5 commits into from
Jul 3, 2025
Merged

fix: enhance CA certificate handling in entrypoint script #40933

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1c595ef
fix: enhance CA certificate handling in entrypoint script
pratapaprasanna Jun 12, 2025
a24eb7a
fix: improve CA certificate processing in entrypoint script
pratapaprasanna Jun 19, 2025
addd941
fix: add warning for incorrect CA certificate file extensions in entr…
pratapaprasanna Jun 19, 2025
cbf51a5
refactor: enhance CA certificate splitting logic in entrypoint script
pratapaprasanna Jun 27, 2025
534af3a
fix: refine CA certificate detection logic in entrypoint script
pratapaprasanna Jul 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 24 additions & 5 deletions deploy/docker/fs/opt/appsmith/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,14 +359,17 @@ setup-custom-ca-certificates() (
local stacks_ca_certs_path="$stacks_path/ca-certs"
local store="$TMP/cacerts"
local opts_file="$TMP/java-cacerts-opts"
local temp_cert_dir="$TMP/ca-certs-temp"

rm -f "$store" "$opts_file"
rm -rf "$temp_cert_dir"
mkdir -p "$temp_cert_dir"

if [[ -n "$(ls "$stacks_ca_certs_path"/*.pem 2>/dev/null)" ]]; then
tlog "Looks like you have some '.pem' files in your 'ca-certs' folder. Please rename them to '.crt' to be picked up automatically.".
fi

if ! [[ -d "$stacks_ca_certs_path" && "$(find "$stacks_ca_certs_path" -maxdepth 1 -type f -name '*.crt' | wc -l)" -gt 0 ]]; then
if ! [[ -d "$stacks_ca_certs_path" && "$(find "$stacks_ca_certs_path" -maxdepth 1 \( -type f -name '*.crt' -o -type l -name '*.crt' \) | wc -l)" -gt 0 ]]; then
tlog "No custom CA certificates found."
return
fi
Expand All @@ -378,15 +381,31 @@ setup-custom-ca-certificates() (
-srcstorepass changeit \
-deststorepass changeit

# Add the custom CA certificates to the store.
find -L "$stacks_ca_certs_path" -maxdepth 1 -type f -name '*.crt' \
-print \
-exec keytool -import -alias '{}' -noprompt -keystore "$store" -file '{}' -storepass changeit ';'
# Split every .crt file (bundle or single) into individual certs
cert_index=0
while read -r cert_file; do
awk -v prefix="$temp_cert_dir/cert" -v ext=".crt" -v idx="$cert_index" '
BEGIN {n=0}
/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/ {
print > (prefix idx "_" n ext)
if (/-----END CERTIFICATE-----/) n++
}
' "$cert_file"
cert_index=$((cert_index + 1))
done < <(find -L "$stacks_ca_certs_path" -maxdepth 1 -type f -o -type l -name '*.crt')

# Import all certificates from the temp directory
find "$temp_cert_dir" -type f -name '*.crt' | while read -r cert_file; do
keytool -import -alias "$(basename "$cert_file")" -noprompt -keystore "$store" -file "$cert_file" -storepass changeit
done

{
echo "-Djavax.net.ssl.trustStore=$store"
echo "-Djavax.net.ssl.trustStorePassword=changeit"
} > "$opts_file"

# Cleanup
rm -rf "$temp_cert_dir"
)

configure_supervisord() {
Expand Down