itzg/cert-helper repository overview

⁠cert-helper

A Docker image that helps with self-signed/cluster signed certificate creation for use in other Docker containers

⁠Usage

If you plan on creating more than one certificate to be signed by the same CA it is very important to either attach a host directory to /ca or create a volume to be re-used on subsequent run invocations:

To create a volume:

docker volume create --name ca-certs

⁠Always use interactive TTY

In order to allow openssl to successfully prompt for the CA key's password be sure to always specify -it (or --interactive=true --tty=true) when using the init or create commands.

⁠Initialize the CA

Use the init command to initialize the /ca volume:

docker run -it -v ca-certs:/ca itzg/cert-helper init

or if you're attaching a host directory called ca in the current directory:

docker run -it -v $(pwd)/ca:/ca itzg/cert-helper init

⁠Generate a signed certificate

Using a Docker volume to be attached to a server/application container for TLS usage:

docker volume create --name server-certs
docker run -it -v <host volume>:/ca -v server-certs:/certs itzg/cert-helper create

or if you're attaching a host directory called certs:

docker run -it -v <host volume>:/ca -v $(pwd)/certs:/certs itzg/cert-helper create

In both of the above, <host volume> is either the explicitly created volume or the host directory used in the init invocation above.

To confirm the content of the created certificate:

docker run -it -v <ca host volume>:/ca:ro -v <certs host volume>:/certs:ro cert-helper show

Notice the volumes can (and should be) attached read-only using the :ro attachment option. This is also how the certificates should be attached to your server/application container to avoid accidental corruption.

⁠Use local directory instead

Rather than generate into Docker volumes, like above, you can also generate them into host directories.

For example,

mkdir -p certs/ca
docker run -it --rm -u $(id -u) \
  -v $(pwd)/certs/ca:/ca -v $(pwd)/certs:/certs itzg/cert-helper \
  init

⁠TODO

NOTE: This image does not yet handle re-issuing an expired CA or signed certificates.