Replies: 2 comments 1 reply
-
Entrypoint Wrapper Script Solution for Private CA CertificatesYou can create an entrypoint wrapper script that installs your private CA certificate before starting the DNS server. You just mount the script and your certificates. 1. Create the wrapper scriptSave this as #!/bin/bash
# Copy custom CA certificates if they exist
if [ -d /custom-certs ] && [ "$(ls -A /custom-certs 2>/dev/null)" ]; then
echo "Installing custom CA certificates..."
cp /custom-certs/*.crt /usr/local/share/ca-certificates/ 2>/dev/null || true
update-ca-certificates
echo "Custom CA certificates installed."
fi
# Execute the original entrypoint/command
exec "$@"Make it executable: chmod +x entrypoint-wrapper.sh2. Docker Compose configurationservices:
dns-server:
image: technitium/dns-server:latest
entrypoint: ["/entrypoint-wrapper.sh"]
command: ["/opt/technitium/dns/start.sh"]
volumes:
- ./entrypoint-wrapper.sh:/entrypoint-wrapper.sh:ro
- ./certs:/custom-certs:ro # Put your CA .crt files here
- dns-config:/etc/dns
ports:
- "53:53/udp"
- "53:53/tcp"
- "5380:5380/tcp"
restart: unless-stopped
volumes:
dns-config:3. Add your CA certificatePlace your private CA certificate in the Important notes
Directory structureThis solution should address the errors you're seeing without too much fuss. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for explaining another solution so clearly! I have looked into possible solutions in more detail. It seems to me that the solution with the least amount of maintenance burden is in fact to mount Obviously, that only works if the container is hosted on a machine that uses the same mechanism to maintain its list of certificate authorities. At least for Linux that should be the case. For the sake of completeness: installing my root CA indeed resolves the error in the DNS client. So, this really is the root cause. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the post. Good to know that you found an easy solution. Installing private CA is a generic requirement which has to be done using the solutions like the one you found. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I am using the Technitium docker image as DNS server for my internal network. All internal SSL is based on an internal CA that is installed on all systems.
However, that causes problems with the fantastic internal DNS client when you're trying to query the corresponding Technitium instance. Here is an example when I try to query the DNS name of Technitium with DNS over TLS.
I assume this error is caused by the fact that the docker image does not contain my certificate authority and therefore the Technitium DNS client (correctly) cannot verify the certificate chain.
There are a couple of possible solutions, and I was wondering which one would be best:
/etc/ssl/certs/ca-certificates.crtinto the container. It is my understanding that you can't just mount your own CA as a single file because that would require updating the central certificate store. This solution is also inconvenient, even though a little better than the first solutionI am wondering if there is any other functionality that could run into the same problems (e.g. cluster updates?)?
What do you think?
Beta Was this translation helpful? Give feedback.
All reactions