Install certificate manually

To add the certificate to your Dockerfile to install it during the build process:

Add the certificate install directions to your Dockerfile. For example:

FROM registry.access.redhat.com/ubi9/ubi:latest
# Or FROM centos:7 or FROM fedora:38

# Install necessary certificates package
RUN dnf install -y ca-certificates

# Copy and add Cloudflare root certificate
COPY certs/certificate.pem /etc/pki/ca-trust/source/anchors/certificate.crt
RUN update-ca-trust extract

FROM debian:12
# Or FROM ubuntu:22.04

# Install necessary certificates package
RUN apt-get update && apt-get install -y ca-certificates

# Copy and add Cloudflare root certificate
COPY certs/certificate.pem /usr/local/share/ca-certificates/certificate.crt
RUN update-ca-certificates

FROM alpine:3.18

# Install necessary certificates package
RUN apk add --no-cache ca-certificates

# Copy and add Cloudflare root certificate
COPY certs/certificate.pem /usr/local/share/ca-certificates/certificate.crt
RUN update-ca-certificates

Build the Docker image:

docker build -t <your-container-name> .

Verify the certificate was installed:

docker run --rm your-image-name sh -c "cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | grep Cloudflare"

docker run --rm your-image-name sh -c "cat /etc/ssl/certs/certificate.pem"

To add the certificate to your Docker Compose file to install it during runtime:

Add the certificate install directions to your docker-compose.yml file. For example:

version: '3'
services:
  redhat-app:
    image: registry.access.redhat.com/ubi9/ubi:latest
     volumes:
       - certs/certificate.pem:/etc/pki/ca-trust/source/anchors/certificate.pem
     entrypoint: /bin/sh -c "dnf install -y ca-certificates && update-ca-trust extract && app start"

version: '3'
services:
  debian-app:
    image: debian:12
     volumes:
       - certs/certificate.pem:/usr/local/share/ca-certificates/certificate.crt
     entrypoint: /bin/sh -c "apt-get update && apt-get install -y ca-certificates && update-ca-certificates && app start"

version: '3'
services:
  alpine-app:
    image: alpine:3.18
     volumes:
       - certs/certificate.pem:/usr/local/share/ca-certificates/certificate.pem
     entrypoint: /bin/sh -c "apk add --no-cache ca-certificates && update-ca-certificates && app start"

Run the container:

docker-compose up

Verify the certificate was installed:

docker exec -it <container-name> sh -c "cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | grep Cloudflare"

docker exec -it <container-name> sh -c "cat /etc/ssl/certs/ca-certificates.crt | grep Cloudflare"

Java may have multiple certificate keystore locations depending on different installations or applications that include Java. Depending on your Java Virtual Machine (JVM) installation, you may need to install the certificate for each instance. You may also need to manually configure each Java application to use and trust the certificate.

To install a Cloudflare root certificate in the system JVM, follow the procedure for your operating system. These steps require you to download a .pem certificate .

• macOS and Linux
• Windows

Install OpenSSL ↗ .

In a terminal, format the Cloudflare certificate for Java.

openssl x509 -in Cloudflare_CA.pem -inform pem -out Cloudflare_CA.der -outform der

Import the converted certificate into the Java keystore.

sudo $JAVA_HOME/bin/keytool -import -trustcacerts -alias 'Cloudflare Root CA' -file Cloudflare_CA.der -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -noprompt 2>&1

Restart any instances of Java.

Install OpenSSL for Windows ↗ .

In an administrator PowerShell terminal, format the Cloudflare certificate for Java.

openssl x509 -in Cloudflare_CA.pem -inform pem -out Cloudflare_CA.der -outform der

Import the converted certificate into the Java keystore.

"%JAVA_HOME%\bin\keytool" -import -trustcacerts -alias "Cloudflare Root CA" -file Cloudflare_CA.der -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit -noprompt

Restart any instances of Java.

Google Cloud

Google Cloud SDK

The commands below will set the Google Cloud SDK to use a Cloudflare certificate. For more information on configuring the Google Cloud SDK, refer to the Google Cloud documentation ↗ .

Get curl's cacert bundle.

curl --remote-name https://curl.se/ca/cacert.pem

Download a Cloudflare certificate in .pem format.

Combine the certs into a single .pem file.

cat cacert.pem 




    
certificate.pem > ~/ca.pem

Configure Google Cloud to use the combined .pem .

gcloud config set core/custom_ca_certs_file ~/ca.pem

Kaniko

If you use Kaniko with Google Cloud SDK, you must install a Cloudflare certificate in the Kaniko CA store ↗ . For more information, refer to the gcloud documentation ↗ .

Google Apps Manager (GAM)

Google Apps Manager (GAM) uses its own certificate store. To add a Cloudflare certificate to GAM, refer to the GAM documentation ↗ .

Google Drive

To trust a Cloudflare root certificate in the Google Drive desktop application, follow the procedure for your operating system. These steps require you to download a .pem certificate .

• macOS
• Windows

In a terminal, copy the contents of the Google Drive certificate file to a new certificate file in a permanent location, such as your Documents folder. For example:

cat /Applications/"Google Drive.app"/Contents/Resources/roots.pem > ~/Documents/gdrivecerts.pem

Append the contents of the downloaded certificate to the end of the new file. For example:

cat ~/Downloads/certificate.pem >> ~/Documents/gdrivecerts.pem

Apply the newly created root certificate to your Google Drive application. For example:

sudo defaults write /Library/Preferences/com.google.drivefs.settings TrustedRootCertsFile "/Users/$(whoami)/Documents/gdrivecerts.pem"

You can verify the update with the following command.

defaults read /Library/Preferences/com.google.drivefs.settings

For more information, refer to the Google documentation ↗ for the TrustedRootCertsFile setting.

AWS CLI

To use a Cloudflare root certificate with AWS CLI, configure it in your AWS configuration files:

• Global config
• Environment variable

To persistently set the location of the certificate:

Download a Cloudflare certificate in .pem format.

Locate and open your AWS configuration file ↗ .

Configure the ca_bundle setting ↗ with the location of your certificate. For example:

[default]
region = us-west-1

ca_bundle = C:\certificate.pem

Restart your terminal.