[SOLVED] Trusted Root Certificates in DotNet Core on Linux (RHEL 7.1)

Issue

I'm currently deploying a .net-core web-api to an docker container on rhel 7.1. Everything works as expected, but from my application I need to call other services via https and those hosts use certificates signed by self-maintained root certificates.

In this constellation I get ssl-errors while calling this services (ssl-not valid) and therefore I need to install this root-certificate in the docker-container or somehow use the root-certificate in the .net-core application.

How can this be done? Is there a best practice to handle this situation? Will .net-core access the right keystore on the rhel-system?

Solution

Since .NET Core uses OpenSSL on linux, you need to set up your linux environment in the container so that OpenSSL will pick up the certificate.

This is done by (+ Dockerfile examples):

1. Copying the the certificate .crt file to a location that update-ca-certificates will scan for trusted certificates - e.g. /usr/local/share/ca-certificates/ or on RHEL /etc/pki/ca-trust/source/anchors/:

    COPY myca.crt /usr/local/share/ca-certificates/
   

2. Invoking update-ca-certificates:

    RUN update-ca-certificates
   

Answered By - Martin Ullrich