Use your own certificate authority bundle

You can use your organization’s certificate authority (CA) bundle when signing and verifying build artifacts with Red Hat Trusted Artifact Signer (RHTAS).

Before you begin

  • The RHTAS Operator is installed on Red Hat OpenShift Container Platform.
  • A running Securesign instance.
  • Your CA root certificate.
  • A workstation with the oc binary installed.

Procedure

  1. Log in to OpenShift from the command line: 
    oc login --token=TOKEN --server=SERVER_URL_AND_PORT
     
    $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
    Note

    You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.
  2. Switch to the RHTAS project: 
    $ oc project trusted-artifact-signer
  3. Create a new ConfigMap by using your organization’s CA root certificate bundle: 
    $ oc create configmap custom-ca-bundle --from-file=ca-bundle.crt
    Important
    The certificate filename must be ca-bundle.crt.
  4. Open the Securesign resource for editing: 
    $ oc edit Securesign securesign-sample
    1. Add the rhtas.redhat.com/trusted-ca annotation under the metadata.annotations section: 
      apiVersion: rhtas.redhat.com/v1alpha1
kind: Securesign
metadata:
  name: securesign-sample
  annotations:
    rhtas.redhat.com/trusted-ca: custom-ca-bundle
spec:
  # ...
    2. Save, and quit the editor.
  5. Open the Fulcio resource for editing: 
    $ oc edit Fulcio securesign-sample
    1. Add the rhtas.redhat.com/trusted-ca annotation under the metadata.annotations section: 
      apiVersion: rhtas.redhat.com/v1alpha1
kind: Fulcio
metadata:
  name: securesign-sample
  annotations:
    rhtas.redhat.com/trusted-ca: custom-ca-bundle
spec:
  # ...
    2. Save, and quit the editor.
  6. Wait for the RHTAS Operator to reconfigure before signing and verifying artifacts.