DependencyTrack / DependencyTrack/dependency-track

More convenient support for custom CA Certificates

Open
#4,097 0 comments 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

There are two options today to support custom CA Certificates:

1. Extract the current trustore from a specific `dependencytrack/apiserver` image, add the custom certificate, and mount the result as a volume (as described in https://docs.dependencytrack.org/getting-started/internal-ca).
2. Build and maintain a custom image to add the custom certificate directly in the image.

### Proposed Behavior

In the cloud native Java space, solutions exist to make adding custom CA Certificates (PEM-format) convenient when running Java applications in container environments like Docker or Kubernetes. One such solution is provided by [Cloud Native Buildpacks](https://buildpacks.io/), a polyglot solution for building images with wide support across the Java ecosystem (including Spring Boot, Quarkus, OpenLiberty, and more). Specifically, [Paketo Buildpacks](https://paketo.io/docs/howto/java/) (the most used Buildpacks implementation), allows to build images with out-of-the-box support for [externalized CA Certificates management](https://github.com/paketo-buildpacks/ca-certificates) (without changing the application code), very convenient for Docker and Kubernetes deployments.

I wonder if it could be an idea to adopt a Buildpacks-based strategy for the Dependency Track image instead of a Dockerfile (I would be available to contribute a PoC, if there's interest) or if a similar solution could be implemented on top of the current Dockerfile-based strategy.

Such a solution would allow mounting a volume with standard PEM certificates (the format companies usually adopt for their internal certificates) to the Dependency Track image without having to go through the extra and special steps to build a Java trustore using the Java utilities (a process that creates friction in a cloud native scenario). This problem has been tackled by frameworks like Spring Boot ([SslBundle](https://spring.io/blog/2023/06/07/securing-spring-boot-applications-with-ssl)) and Quarkus ([TLS Registry](https://quarkus.io/guides/tls-registry-reference)) to allow working with PEM certificates directly and support loading them at startup/run time.

Supporting mounting PEM certificates would enable more cloud-native integrations. For example, it would be possible to use [cert-manager](https://cert-manager.io/) (the de-facto certificate management solution in Kubernetes) to provide trust certificates to Dependency Track in the same way as done across all other applications running on a cloud native platform (using the [trust-manager](https://cert-manager.io/docs/trust/trust-manager/) component).

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.