quay/conf/init/create_certs.sh

#! /bin/bash
set -e

# Create certs for jwtproxy to mitm outgoing TLS connections
echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' | cfssl gencert -initca - | cfssljson -bare mitm
cp mitm-key.pem /conf/mitm.key
cp mitm.pem /conf/mitm.cert
cp mitm.pem /usr/local/share/ca-certificates/mitm.crt

# Add extra trusted certificates
if [ -d /conf/stack/extra_ca_certs ]; then
	cp /conf/stack/extra_ca_certs/* /usr/local/share/ca-certificates/
fi

update-ca-certificates
Creat mitm certs on boot 2016-04-25 21:13:38 +00:00			`#! /bin/bash`
			`set -e`

address review comments - more inline documentation - don't explicitly specify audience - approver is optional in `generate_key` - ADD -> RUN for better caching of jwtproxy 2016-04-29 01:10:28 +00:00			`# Create certs for jwtproxy to mitm outgoing TLS connections`
Creat mitm certs on boot 2016-04-25 21:13:38 +00:00			`echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' \| cfssl gencert -initca - \| cfssljson -bare mitm`
			`cp mitm-key.pem /conf/mitm.key`
			`cp mitm.pem /conf/mitm.cert`
			`cp mitm.pem /usr/local/share/ca-certificates/mitm.crt`

Allow adding extra CA certificates to the system 2016-04-29 21:25:45 +00:00			`# Add extra trusted certificates`
			`if [ -d /conf/stack/extra_ca_certs ]; then`
			`cp /conf/stack/extra_ca_certs/* /usr/local/share/ca-certificates/`
			`fi`

Creat mitm certs on boot 2016-04-25 21:13:38 +00:00			`update-ca-certificates`