generate a self signed certificate in docker

Question

I need to generate a self signed certificate when the docker starts . basically our docker is started using concourse ci . So it has to be in the dockerfile and cannot use any options using docker run .

Let me know any inputs for this

Answer 1

What is wrong with simple RUN command? It works for me and the self-signed certificate is created successfully.

FROM debian:wheezy

RUN apt-get update && \
    apt-get install -y openssl && \
    openssl genrsa -des3 -passout pass:x -out server.pass.key 2048 && \
    openssl rsa -passin pass:x -in server.pass.key -out server.key && \
    rm server.pass.key && \
    openssl req -new -key server.key -out server.csr \
        -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com" && \
    openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Once in Dockerfile, the certificate is created only once during the image build; then you have the certificate available in the image.

If you need a new self-signed certificate each time a container starts, it's possible with the use of an external shell script. Like so:

#!/bin/bash

openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
openssl rsa -passin pass:x -in server.pass.key -out server.key
rm server.pass.key
openssl req -new -key server.key -out server.csr \
    -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

And then put that shell script into your Dockerfile and set up the default execution:

FROM debian:wheezy

RUN apt-get update && \
    apt-get install -y openssl

COPY generate-certificate.sh /tmp/generate-certificate.sh

CMD [ "/tmp/generate-certificate.sh" ]

In this case each time you start a container with docker run ...., a new unique certificate is generated.