Allow `SERVER_CA_BUNDLE` to use a directory of CA certificates
@maany is already working on this.
Since Sep 15, 2026.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 36
- Avg merge
- 6d 17h
- Merged PRs (30d)
- 7
Description
Description
Extend SERVER_CA_BUNDLE to support a directory containing individual CA certs, in addition to the CA bundle currently supported.
Motivation
In CMS DM, the required CA certificates are already available as individual certificate files through cvmfs. We would like to use these certificates directly instead of creating and maintaining a separate CA bundle (e.g. through k8s secrets).
With the current SERVER_CA_BUNDLE implementation, a bundle has to be provided explicitly, which means that certificates that are already available in the environment need to be duplicated and maintained separately.
Change
Extend SERVER_CA_BUNDLE to accept a path to a directory containing individual CA certificates.
For example:
server_ca_bundle: /cvmfs/grid.cern.ch/etc/grid-security/certificates/
The existing behavior, where SERVER_CA_BUNDLE points to a CA bundle, should remain unchanged. Alternatively, a new environment variable could be introduced to specify a directory containing individual CA certificates.
Additional Information
- The Rucio API needs to be changed.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.