DependencyTrack / DependencyTrack/dependency-track
More convenient support for custom CA Certificates
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
There are two options today to support custom CA Certificates:
1. Extract the current trustore from a specific `dependencytrack/apiserver` image, add the custom certificate, and mount the result as a volume (as described in https://docs.dependencytrack.org/getting-started/internal-ca).
2. Build and maintain a custom image to add the custom certificate directly in the image.
### Proposed Behavior
In the cloud native Java space, solutions exist to make adding custom CA Certificates (PEM-format) convenient when running Java applications in container environments like Docker or Kubernetes. One such solution is provided by [Cloud Native Buildpacks](https://buildpacks.io/), a polyglot solution for building images with wide support across the Java ecosystem (including Spring Boot, Quarkus, OpenLiberty, and more). Specifically, [Paketo Buildpacks](https://paketo.io/docs/howto/java/) (the most used Buildpacks implementation), allows to build images with out-of-the-box support for [externalized CA Certificates management](https://github.com/paketo-buildpacks/ca-certificates) (without changing the application code), very convenient for Docker and Kubernetes deployments.
I wonder if it could be an idea to adopt a Buildpacks-based strategy for the Dependency Track image instead of a Dockerfile (I would be available to contribute a PoC, if there's interest) or if a similar solution could be implemented on top of the current Dockerfile-based strategy.
Such a solution would allow mounting a volume with standard PEM certificates (the format companies usually adopt for their internal certificates) to the Dependency Track image without having to go through the extra and special steps to build a Java trustore using the Java utilities (a process that creates friction in a cloud native scenario). This problem has been tackled by frameworks like Spring Boot ([SslBundle](https://spring.io/blog/2023/06/07/securing-spring-boot-applications-with-ssl)) and Quarkus ([TLS Registry](https://quarkus.io/guides/tls-registry-reference)) to allow working with PEM certificates directly and support loading them at startup/run time.
Supporting mounting PEM certificates would enable more cloud-native integrations. For example, it would be possible to use [cert-manager](https://cert-manager.io/) (the de-facto certificate management solution in Kubernetes) to provide trust certificates to Dependency Track in the same way as done across all other applications running on a cloud native platform (using the [trust-manager](https://cert-manager.io/docs/trust/trust-manager/) component).
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.