Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[fix] Add OpenSSL ini config for PHP with custom cafile path #44

Merged
merged 7 commits into from
Jan 10, 2025
Merged

[fix] Add OpenSSL ini config for PHP with custom cafile path #44

merged 7 commits into from
Jan 10, 2025

Conversation

subiabre
Copy link
Member

@subiabre subiabre commented Jan 7, 2025 •
edited
Loading

Solution for #43, a path is set to use a custom cafile for OpenSSL.

@davidbeig can you help me put the code in place to get the file from https://curl.se/docs/caextract.html in the docker build step? Thank you!

@subiabre subiabre requested a review from davidbeig January 7, 2025 10:40
@subiabre
Copy link
Member Author

subiabre commented Jan 7, 2025

@davidbeig SSL works fine on the pipeline, maybe we can leave the custom cafile step for dev.

@davidbeig davidbeig mentioned this pull request Jan 9, 2025
Merged
davidbeig
davidbeig requested changes Jan 9, 2025
View reviewed changes
Copy link
Member

@davidbeig davidbeig left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi!

I have just added the curl command to the Dockerfile, since it's in the base image it will be shared with the dev and prod envs.

What i don't get is the volumes that you are adding. Since we need the image to come with the file already in it, how's that you add it also to the docker-compose? In case we update it locally?

Could you try that the last commit works as expected?

@subiabre
Copy link
Member Author

subiabre commented Jan 9, 2025 •
edited
Loading

@davidbeig

There is an issue due to filenaming mismatch. PHP was instructed to use the file from /etc/ssl/ca-bundle.crt via openssl.ini config, while the Dockerfile places the downloaded file at /etc/ssl/certs/ca-certificates.crt.

Regarding on why the volumes:

  • ./docker/php/ssl/ca-bundle.crt:/etc/ssl/ca-bundle.crt:ro was added so we could easily place a test .crt file at /docker/php/ssl for testing purposes.
  • ./docker/php/conf.d/openssl.ini:/usr/local/etc/php/conf.d/openssl.ini:ro is added in order to config PHP and explicitly tell which certs bundle should be used for OpenSSL operations.

You can resolve the path namings as you wish. Thanks!

@subiabre
Copy link
Member Author

@davidbeig

Works like a charm now! I moved the testing volume to the override compose config.

Can we also merge #45 now?

@davidbeig davidbeig merged commit 5848a50 into main Jan 10, 2025
2 checks passed
@davidbeig davidbeig deleted the fix/ecb_ssl branch January 10, 2025 09:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@davidbeig davidbeig davidbeig requested changes

Assignees

@davidbeig davidbeig

@subiabre subiabre

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@subiabre @davidbeig