futureys/ssl-certificate
Dockerfile for self-signed SSL certificate.
3.2K
futureys/ssl-certificate repository overview
What is SSL Certificate?
Creates wildcard self-signed SSL certificate.
List of output files
/etc/pki/CA/private/cakey.pem
Private key for Certificate Authority
/etc/pki/CA/cacert-<domain name>.csr
Certificate Server Request for Certificate Authority
/etc/pki/CA/cacert-<domain name>.pem
Certificate for Certificate Authority itself
/etc/pki/tls/private/serverkey-<domain name>.pem
Private key for server
/etc/pki/tls/certs/servercert-<domain name>.csr
Certificate Server Request for server
/etc/pki/tls/certs/servercert-<domain name>.pem
Certificate for server
How to use this image
docker run --env DOMAIN_NAME=exampledomain.com \
-v $(pwd)/CA:/etc/pki/CA \
-v $(pwd)/tls/certs:/etc/pki/tls/certs \
-v $(pwd)/tls/private:/etc/pki/tls/private \
futureys/ssl-certificate
... via docker compose
This example is to enable SSL on MySQL database.
1.
Prepare compose.yml:
---
services:
ssl-certificate:
environment:
DOMAIN_NAME: database
SUPPORT_ROOT_DOMAIN: true
image: futureys/ssl-certificate:latest
volumes:
- pki:/etc/pki
database:
command:
- --ssl-ca=/etc/pki/CA/cacert-database.pem
- --ssl-cert=/etc/pki/tls/certs/servercert-database.pem
- --ssl-key=/etc/pki/tls/private/serverkey-database.pem
depends_on:
ssl-certificate:
condition: service_completed_successfully
entrypoint: setup-certificate.sh
environment:
MYSQL_ROOT_PASSWORD: ${DATABASE_ROOT_PASSWORD}
healthcheck:
test:
- CMD
- mysqladmin
- ping
- -h
- localhost
- -u
- root
- -pexamplepass
- --ssl-mode=REQUIRED
interval: 5s
timeout: 10s
retries: 5
start_period: 30s # Adjust based on your MySQL initialization time
image: mysql:9.5.0
volumes:
# To enable SSL for MySQL serving.
- pki:/etc/pki
- ./database_entrypoint/setup-certificate.sh:/usr/local/bin/setup-certificate.sh
# For MySQL less than 9.0.0 to enable SSL connection enforcement.
- ./mysql_conf.d:/etc/mysql/conf.d
volumes:
pki:
2.
If you are using MySQL less than 9.0.0, prepare mysql_conf.d/ssl.cnf:
[mysqld]
# To force SSL connection
require_secure_transport = ON
3.
Prepare Shell Script ./database_entrypoint/setup-certificate.sh
to wait for creating certificate and set appropriate permission to certificate before MySQL start:
set -eu
DOMAIN_NAME=${DOMAIN_NAME-database}
SERVERKEY="/etc/pki/tls/private/serverkey-${DOMAIN_NAME}.pem"
group_database=$([ $(which postgres) ] && echo "postgres" || echo "mysql")
chown "root:${group_database}" "${SERVERKEY}"
chmod 640 "${SERVERKEY}"
# "docker-entrypoint.sh" is default ENTRYPOINT of Docker Hub official database images.
# see: https://github.com/docker-library/mysql/blob/8e6735541864ab63c98cdf92d3ef498e4c953f3e/8.0/Dockerfile
# see: https://github.com/docker-library/mysql/blob/8e6735541864ab63c98cdf92d3ef498e4c953f3e/5.7/Dockerfile
# see: https://github.com/docker-library/mysql/blob/8e6735541864ab63c98cdf92d3ef498e4c953f3e/5.6/Dockerfile
# see: https://github.com/docker-library/postgres/blob/b80fcb5ac7f6dde712e70d2d53a88bf880700fde/Dockerfile-debian.template
# see: https://github.com/docker-library/postgres/blob/b80fcb5ac7f6dde712e70d2d53a88bf880700fde/Dockerfile-alpine.template
exec docker-entrypoint.sh "$@"
4.
Run docker-compose up, then SSL enabled MySQL will start.
Access web service by browser
1.
Pick up self signed certificate from shared volume.
For example, in case when web container using volume:
docker cp web:/etc/pki/CA/cacert-database.pem ./cacert-database.pem
2.
Install cacert-database.pem into your browser.
cf. Answer: How do I deal with NET:ERR_CERT_AUTHORITY_INVALID in Chrome?
Environment Variables
DOMAIN_NAME
Domain name for install SSL certificate.
SUPPORT_ROOT_DOMAIN
Whether to support root domain for SSL certificate installation.
Set to true to support root domain.
Default is not to support it.
License
View license information for the software contained in this image.
As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
Tag summary
Content type
Image
Digest
sha256:be5652b65…
Size
114.4 MB
Last updated
10 months ago
docker pull futureys/ssl-certificate