How to rely on self-signed certifications

When your venture environment intercepts and checks HTTPS website traffic at a proxy, that proxy is running as a man-in-the-middle (MITM) This is exactly the scenario that HTTPS is created to shield against. To get your applications to play nice with a proxy like ZScaler, you need to compel them to trust its origin certificate, which is not part of the internationally accepted set of origin certificates. System managers or your proxy client (e.g. Zscaler Customer Adapter) generally make sure that your system’s trust package, used by applications such as your web browser and the OS itself, includes these origin certifications.

The issue

The visibility of your firm’s origin certificates allows you to do jobs like browsing the web. Sadly, not all applications utilize your system’s trust bundle by default, resulting in mistakes like this:

  curl: (60 SSL certification problem: self-signed certification in certificate chain  

Actually, most manuscripts (Python, Node.js) do not integrate with the system trust bundle. Instead, they deliver with their very own packages. I have actually spent even more time than I would like admit managing related problems.

This blog post notes some methods to develop a count on package– ideally by extracting the system’s depend on package into a PEM data– and how to obtain different applications to trust it by establishing environment variables.

Action 1: Creating a trust fund package

The primary step is to create a count on bundle that includes your corporate root certificates. I like to do this by extracting the system’s trust fund bundle into a PEM data. Depending on your environment, you may intend to consist of public origin certifications too. It almost certainly does not hurt to include them.

Every os has its own way of saving and accessing the system count on package.

On MacOS

On MacOS, the system’s trust bundle is kept on your system keychain. You can remove it using the adhering to practical commands:

  safety find-certificate -a -p/ System/Library/Keychains/ SystemRootCertificates.keychain > > |/. bundle.pem 
 protection find-certificate -a -p/ System/Library/Keychains/ System.keychain >> > > |/. bundle.pem  

It appears to me that the SystemRootCertificates.keychain includes the certificates that deliver with macOS, and the System.keychain consists of extra certifications included by managers or business tools.

On Linux

Linux circulations usually store your system’s count on bundle already in a PEM data. All you need to do is identify its area. This place relies on your particular circulation.

• On Debian-based systems (Debian, Ubuntu, Mint, …), it lies at / etc/ssl/certs/ ca-certificates. crt
• On Red Hat-based systems (RHEL, CentOS, Fedora, Amazon Linux), it lies at / etc/pki/ca-trust/ extracted/openssl/ca-bundle. trust.crt

Your OS normally assembles this bundle from a collection of PEM files that are kept in a various location. On Debian/Ubuntu, for example , certificates are stored in / usr/local/share/ ca-certificates/ , and put together into a bundle by the update-ca-certificates command. On Red Hat-based systems, certificates are stored in / etc/pki/ca-trust/ source/anchors/ and compiled utilizing update-ca-trust

On Windows and various other systems

Like MacOS, Windows stores your system’s trust package on your system keychain. Unlike MacOS, it does not provide practical commands for extracting it into a PEM file.

Some mix of PowerShell commands and/or contacts us to certutil enable you to remove the system trust bundle. This is non-trivial, and corporate atmospheres usually limit any type of shell gain access to on Windows equipments anyhow. So on Windows, instead of extracting the system trust bundle, I often tend to create “my very own” instead , beginning with Python’s default certifi trust fund bundle and adding extra root certifications to it.

Unlike MacOS, Windows does deficient very easy to remove your system trust fund bundle.

You can obtain the certifi trust fund package from its GitHub database :

  curl https://raw.githubusercontent.com/certifi/python-certifi/refs/heads/master/certifi/cacert.pem > > |/. bundle.pem  

To get the added certificates to trust fund, that is, the certifications utilized by the corporate proxy, you have numerous choices:

• You can ask your admin for it;
• You can often locate it hosted on Sharepoint or Confluence;
• You can likewise bring it from the “man-in-the-middle” on your own.

I like the last choice. If openssl is mounted, you can utilize it to examine offered certificates:

  hostname=google.com # any kind of other hostname serving the untrusted certificate 
 openssl s_client -showcerts -link "$hostname": 443  > "$conffile" 
 resemble "export SSL_CERT_DIR= |/. bundle.pem" >> > > "$conffile" 
 resemble "export CURL_CA_BUNDLE= |/. bundle.pem" >> > > "$conffile" 
 echo "export REQUESTS_CA_BUNDLE= |/. bundle.pem" >> > > "$conffile" 
 echo "export NODE_EXTRA_CA_CERTS= |/. bundle.pem" >> > > "$conffile" 
 resemble "export CARGO_HTTP_CAINFO= |/. bundle.pem" >> > > "$conffile" 
 echo "export GIT_SSL_CAINFO= |/. bundle.pem" >> > > "$conffile"  

On Windows, you can set setting variables from the System UI panel, or you can create a faster way which establishes them locally.

Even more methods for various applications can be located below:

https://help.zscaler.com/zia/adding-custom-certificate-application-specific-trust-store

What about Docker?

Applications running inside a container (e.g. Docker) will certainly utilize the trust bundle that becomes part of the container picture. Basically all container pictures come with a trust fund package, even the minimal ones like distroless

Yes, undoubtedly, this implies that your best self-supporting containerized applications still have a minimal shelf life if they link to the outside web. Because also origin certifications expire, you will have to reconstruct eventually, also if the containerized application itself does not alter.

To make sure that your containerized application trusts your man-in-the-middle, you will need to either:

• bake your personalized bundle into the picture or
• mount your personalized bundle into the container, ideally shadowing the system count on package that becomes part of the image.

Which one is most appropriate depends upon your usage instance, yet typically mounting is favored. You may additionally have to set a few of the setting variables noted over if you are using applications that do not use the system count on package, like we went over above.

For an Ubuntu- or distroless-based picture, this can look like this:

  curl: (60 SSL certification trouble: self-signed certificate in certification chain  

The process of building a picture is itself containerized and may additionally need you to establish similar setups. Docker Desktop computer generally uses your system’s trust bundle out of package, however when you use podman on an OS that is not Linux, you will have to upgrade the trust fund package of the (Linux) VM running your containers. You can do this making use of podman equipment ssh commands.

Originally published at https://welw.it on October 5, 2025