Adding CA Certificate to Java Buildpack for PCF Deployment

jerome.dev :

I want to use the same Java Buildpack that can be found here: https://github.com/cloudfoundry/java-buildpack/ but I want to be able to add a public certificate to this package as my application will not run properly without this installed certificate. How would I go about adding this certificate and deploying the updated buildpack to PCF?

Daniel Mikusa :

I would strongly discourage you from trying to add the cert to the buildpack itself. That requires forking the buildpack and that creates a maintenance burden for you (you essentially need to maintain that fork forever).

Instead, I would suggest you either bundle the cert with your app or use Bosh trusted certs to deploy the cert to all application containers by default.

If you need the cert for just a couple apps, it's easier to bundle it with the apps. If you need it site wide, like a company/internal certificate authority then you should deploy it as a Bosh trusted cert.

To bundle with the app, there are a couple options:

• You can set JAVA_OPTS to include -Djavax.net.ssl.Truststore and point that to the truststore you bundle with the app. Keep in mind this completely overrides the default truststore, so you need to have all the usual defaults plus your custom trusted certs. It's easiest to start with the default truststore and add to it.

  Ex:

  cf set-env <app> JAVA_OPTS '-Djavax.net.ssl.TrustStore=classpath:resources/config/truststore'
  

• You can add a .profile script that runs and imports your custom trusted certs into the default keystore. The contents of your .profile script would look like this.

  #!/bin/bash  
  $HOME/.java-buildpack/open_jdk_jre/bin/keytool -keystore $HOME/.java-buildpack/open_jdk_jre/lib/security/cacerts -storepass changeit -importcert -noprompt -alias MyCert -file $HOME/WEB-INF/ssl/MyCert.crt
  

  It is tricky to get the .profile script in just the right location. It needs to end up in the root of the WAR or JAR file that you generate. If you run jar tf <jar-or-war-file>, you should see .profile listed without any leading path. If there's a path in front of the file, then it's in the wrong place.

Hope that helps!