| <!DOCTYPE html> |
| <html lang="en"> |
| <head> |
| <meta charset="utf-8"> |
| <meta name="viewport" content="width=device-width,initial-scale=1"> |
| <title>Importing untrusted TLS certificates to Che :: Eclipse Che Documentation</title> |
| <link rel="canonical" href="https://www.eclipse.org/che/docs/che-7/installation-guide/importing-untrusted-tls-certificates-old/"> |
| <meta name="keywords" content="installation-guide, tls, certificate"> |
| <meta name="generator" content="Antora 2.3.4"> |
| <link rel="stylesheet" href="../../../_/css/site.css"> |
| <link rel="stylesheet" href="../../../_/css/extra.css"> |
| <link rel="stylesheet" href="../../../_/font-awesome-4.7.0/css/font-awesome.min.css"> |
| <link rel="icon" href="../../../favicon.ico" type="image/x-icon"> |
| <script async src="https://www.googletagmanager.com/gtag/js?id=UA-37306001-2"></script> |
| <script>function gtag(){dataLayer.push(arguments)};window.dataLayer=window.dataLayer||[];gtag('js',new Date());gtag('config','UA-37306001-2')</script> |
| <script>var uiRootPath = '../../../_'</script> |
| </head> |
| <body class="article"> |
| <header class="header" role="banner"> |
| <nav class="navbar"> |
| <div class="navbar-brand"> |
| <div class="navbar-item"> |
| <button class="navbar-burger" data-target="topbar-nav"> |
| <span></span> |
| <span></span> |
| <span></span> |
| </button> |
| <img src="../../../_/img/icon-eclipse-che.svg" class="navbar-logo" alt="Eclipse Che logo"> |
| <a href="https://www.eclipse.org/che/docs">Eclipse Che Documentation</a> |
| </div> |
| </div> |
| <div id="topbar-nav" class="navbar-menu"> |
| <div class="navbar-end"> |
| <div class="navbar-item hide-for-print"> |
| <script async src="https://cse.google.com/cse.js?cx=002898025167115630151:gnr5edrg2eo"></script> |
| <div class="gcse-searchbox" enableAutoComplete="true"></div> |
| </div> |
| <a class="navbar-item" href="https://www.eclipse.org/che/docs">Home</a> |
| <a class="navbar-item" href="https://che.eclipse.org/">Blog</a> |
| <a class="navbar-item" href="https://github.com/eclipse/che">Source Code</a> |
| </div> |
| </div> |
| </nav> |
| <div class="gcse-searchresults"></div> |
| </header><div class="body"> |
| <div class="nav-container" data-component="che-7" data-version="master"> |
| <aside class="nav"> |
| <div class="panels"> |
| <div class="nav-panel-menu is-active" data-panel="menu"> |
| <nav class="nav-menu"> |
| <h3 class="title"><a href="../../overview/introduction-to-eclipse-che/">Documentation</a></h3> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../overview/introduction-to-eclipse-che/">Introduction to Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../overview/che-architecture/">Che architecture</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../hosted-che/hosted-che/">Eclipse Che hosted by Red Hat</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">End-user Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/navigating-che/">Navigating Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/navigating-che-using-the-dashboard/">Navigating Che: dashboard</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/importing-certificates-to-browsers/">Importing certificates to browsers</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/accessing-che-from-openshift-developer-perspective/">Navigating Che from OpenShift Developer Perspective</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/che-theia-ide-basics/">Che-Theia IDE basics</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/defining-custom-commands-for-che-theia/">Defining custom commands for Che-Theia</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/version-control/">Version Control</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/che-theia-troubleshooting/">Che-Theia Troubleshooting</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/differences-in-how-che-theia-webview-works-on-a-single-host-mode-comparing-to-a-multi-host-mode/">Differences in how Che-Theia Webview works on a single-host mode comparing to a multi-host mode</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/workspaces-overview/">Using developer workspaces</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-from-code-sample/">Creating a workspace from code sample</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-from-remote-devfile/">Creating a workspace from a remote devfile using the dashboard</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-from-local-devfile-using-chectl/">Creating a workspace from local devfile using chectl</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-by-importing-the-source-code-of-a-project/">Creating a workspace by importing the source code of a project</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/configuring-a-workspace-with-dashboard/">Configuring a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/running-a-workspace-with-dashboard/">Running a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/importing-kubernetes-applications-into-a-workspace/">Importing Kubernetes applications into a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/remotely-accessing-workspaces/">Remotely accessing workspaces</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/mounting-a-secret-as-a-file-or-an-environment-variable-into-a-workspace-container/">Mounting a secret as a file or an environment variable into a workspace container</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/authenticating-on-scm-server-with-a-personal-access-token/">Authenticating on SCM Server with a personal access token</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/authoring-devfiles/">Authoring devfiles</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/authoring-devfiles-version-1/">Authoring devfiles version 1</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/authoring-devfiles-version-2/">Authoring devfiles version 2</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/customizing-developer-environments/">Customizing developer environments</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/what-is-a-che-theia-plug-in/">What is a Che-Theia plug-in</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/adding-a-vs-code-extension-to-a-workspace/">Adding a VS Code extension to a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/adding-a-vs-code-extension-to-the-che-plugin-registry/">Adding a VS Code extension to the Che plug-ins registry</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/publishing-metadata-for-a-vs-code-extension/">Publishing a VS Code extension</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/testing-a-visual-studio-code-extension-in-che/">Testing a VS Code extension in Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/using-alternative-ides-in-che/">Using alternative IDEs in Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/support-for-jetbrains-ides/">JetBrains IDEs</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/using-jetbrains-intellij-idea-community-edition/">Using IntelliJ Idea Community Edition</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/using-jetbrains-intellij-idea-ultimate-edition/">Using IntelliJ Idea Ultimate Edition</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/configuring-an-existing-workspace-to-use-intellij-idea/">Configuring an existing workspace to use IntelliJ IDEA</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/using-jetbrains-webstorm/">Using WebStorm</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/provisioning-jetbrains-activation-code-for-offline-use/">Provisioning activation code for offline use</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../../end-user-guide/support-for-theia-based-ides/">Theia-based IDEs</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/adding-tools-to-che-after-creating-a-workspace/">Adding tools to Che after creating a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-private-container-registries/">Using private container registries</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/using-artifact-repositories-in-a-restricted-environment/">Using artifact repositories in a restricted environment</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-maven-artifact-repositories/">Using Maven artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-gradle-artifact-repositories/">Using Gradle artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-python-artifact-repositories/">Using Python artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-go-artifact-repositories/">Using Go artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-nuget-artifact-repositories/">Using NuGet artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-npm-artifact-repositories/">Using npm artifact repositories</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/troubleshooting-che/">Troubleshooting Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/viewing-che-workspaces-logs/">Viewing Che workspaces logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/investigating-failures-at-a-workspace-start-using-the-verbose-mode/">Troubleshooting workspace start failures</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/troubleshooting-slow-workspaces/">Troubleshooting slow workspaces</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/troubleshooting-network-problems/">Troubleshooting network problems</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Installation Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../supported-platforms/">Supported platforms</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../configuring-the-che-installation/">Configuring the Che installation</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../installing-che/">Installing Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../installing-che-in-cloud/">Installing Che in cloud</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-openshift-4-using-operatorhub/">Installing Che on OpenShift 4 using OperatorHub</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-openshift-4-using-cli/">Installing Che on OpenShift 4 using CLI</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-openshift-3-using-the-operator/">Installing Che on OpenShift 3</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-kubespray/">Installing Che on Kubespray</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-aws/">Installing Che on AWS</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-google-cloud-platform/">Installing Che on Google Cloud</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-microsoft-azure/">Installing Che on Microsoft Azure</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../installing-che-locally/">Installing Che locally</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-codeready-containers/">Installing Che on CodeReady Containers</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-docker-desktop/">Installing Che on Docker Desktop</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-minikube/">Installing Che on Minikube</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-minishift/">Installing Che on Minishift</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-kind/">Installing Che on Kind</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../using-the-chectl-management-tool/">Using the chectl management tool</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../installing-che-in-a-restricted-environment/">Installing Che in restricted environment</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../advanced-configuration/">Advanced configuration</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../advanced-configuration-options-for-the-che-server-component/">Advanced configuration options for Che server</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-namespace-strategies/">Configuring workspace target namespace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-storage-strategies/">Configuring storage strategies</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-storage-types/">Configuring storage types</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-the-number-of-workspaces-that-a-user-can-run/">Configuring the number of workspaces that a user can run</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-the-number-of-workspaces-that-a-user-can-create/">Configuring the number of workspaces that a user can create</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-workspace-exposure-strategies/">Configuring workspace exposure strategies</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-workspaces-nodeselector/">Configuring workspaces nodeSelector</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-che-hostname/">Configuring Che hostname</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-ingresses/">Configuring Kubernetes Ingress</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-routes/">Configuring OpenShift Route</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../deploying-che-with-support-for-git-repositories-with-self-signed-certificates/">Deploying Che with support for Git repositories with self-signed certificates</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../installing-che-using-storage-classes/">Installing Che using storage classes</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../importing-untrusted-tls-certificates/">Importing untrusted TLS certificates to Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../switching-between-external-and-internal-communication/">Switching between external and internal ways in inter-component communication</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../setting-up-the-keycloak-che-username-readonly-theme-for-the-eclipse-che-login-page/">Setting up the Keycloak che-username-readonly theme for the Eclipse Che login page</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../mounting-a-secret-as-a-file-or-an-environment-variable-into-a-container/">Mounting a Secret or a ConfigMap as a file or an environment variable into a Eclipse Che container</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../enabling-dev-workspace-engine/">Enabling Dev Workspace engine</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../upgrading-che/">Upgrading Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-using-operatorhub/">Upgrading Che using OperatorHub</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-using-the-cli-management-tool/">Upgrading Che using the CLI management tool</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-using-the-cli-management-tool-in-restricted-environment/">Upgrading Che in restricted environment</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-namespace-strategies-other-than-per-user/">Updating Che namespace strategies other than 'per user'</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../uninstalling-che/">Uninstalling Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../uninstalling-che-after-operatorhub-installation-using-openshift-web-console/">Using the OpenShift web console</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../uninstalling-che-after-operatorhub-installation-using-openshift-cli/">Using OpenShift CLI</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../uninstalling-che-after-chectl-installation/">Using chectl</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Administration Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/che-architecture-overview/">Che architecture</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/che-workspace-controller/">Che workspace controller</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/che-workspaces-architecture/">Che workspaces architecture</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../administration-guide/calculating-che-resource-requirements/">Calculating Che resource requirements</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/customizing-the-registries/">Customizing the registries</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/building-custom-registry-images/">Building custom registry images</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/running-custom-registries/">Running custom registries</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/retrieving-che-logs/">Retrieving Che logs</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/configuring-server-logging/">Configuring server logging</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-kubernetes-events/">Accessing Kubernetes events on OpenShift</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-operator-events/">Viewing the Operator events on OpenShift</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-che-server-logs/">Viewing Che server logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-external-service-logs/">Viewing external service logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-plug-in-broker-logs/">Viewing Plug-in broker logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/collecting-logs-using-chectl/">Collecting logs using chectl</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../administration-guide/monitoring-che/">Monitoring Che</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../administration-guide/tracing-che/">Tracing Che</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/backup-and-disaster-recovery/">Backup and disaster recovery</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/external-database-setup/">External database setup</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/persistent-volumes-backups/">Persistent Volumes backups</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/caching-images-for-faster-workspace-start/">Caching images for faster workspace start</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/defining-the-list-of-images-to-pull/">Defining the list of images</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/defining-the-memory-parameters-for-the-image-puller/">Defining the memory settings</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-using-che-operator/">Installing using the Che Operator</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-kubernetes-using-the-image-puller-operator/">Installing using the Kubernetes Image Puller Operator</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-openshift-using-operatorhub/">Installing on OpenShift 4</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-openshift-using-openshift-templates/">Installing on OpenShift 3</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-kubernetes-using-helm/">Installing using Helm</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/managing-identities-and-authorizations/">Managing identities and authorizations</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/authenticating-users/">Authenticating users</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/authorizing-users/">Authorizing users</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/configuring-authorization/">Configuring authorization</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/configuring-openshift-oauth/">Configuring OpenShift OAuth</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/removing-user-data/">Removing user data</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Contributor Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/branding-che-theia/">Branding Che-Theia</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/developing-che-theia-plug-ins/">Developing Che-Theia plug-ins</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/testing-che-theia-plug-ins/">Testing Che-Theia plug-ins</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/publishing-che-theia-plug-ins/">Publishing Che-Theia plug-ins</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/adding-support-for-a-new-language/">Adding support for a new language</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/adding-support-for-a-new-debugger/">Adding support for a new debugger</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../contributor-guide/che-extensibility-reference/">Che extensibility reference</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/che-extension-points/">Che extension points</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/che-theia-plug-in-api/">Che-Theia plug-in API</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/debug-adapter-protocol/">Debug Adapter Protocol</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/language-server-protocol/">Language Server Protocol</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Extensions</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../extensions/eclipse-che4z/">Eclipse Che4z</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../extensions/openshift-connector-overview/">OpenShift Connector</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/features-of-openshift-connector/">Features of OpenShift Connector</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/installing-openshift-connector-in-che/">Installing OpenShift Connector in Eclipse Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/authenticating-with-openshift-connector-from-che/">Authenticating with OpenShift Connector from Eclipse Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/creating-components-with-openshift-connector-in-che/">Creating Components with OpenShift Connector in Eclipse Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/connecting-source-code-from-github-to-a-openshift-component-using-openshift-connector/">Connecting source code from GitHub to a OpenShift Component</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../extensions/telemetry/">Telemetry</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/creating-a-telemetry-plugin/">Creating A Telemetry Plugin</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/the-woopra-telemetry-plugin/">The Woopra Telemetry Plugin</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../extensions/java-lombok/">Java Lombok</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../glossary/che-glossary/">Che glossary</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </nav> |
| </div> |
| <div class="nav-panel-explore" data-panel="explore"> |
| <div class="context"> |
| <span class="title">Documentation</span> |
| <span class="version">master</span> |
| </div> |
| <ul class="components"> |
| <li class="component is-current"> |
| <a class="title" href="../../overview/introduction-to-eclipse-che/">Documentation</a> |
| <ul class="versions"> |
| <li class="version is-current is-latest"> |
| <a href="../../overview/introduction-to-eclipse-che/">master</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </div> |
| </div> |
| </aside> |
| </div> |
| <main class="article"> |
| <div class="toolbar" role="navigation"> |
| <button class="nav-toggle"></button> |
| <a href="../../overview/introduction-to-eclipse-che/" class="home-link"></a> |
| <nav class="breadcrumbs" aria-label="breadcrumbs"> |
| <ul> |
| <li><a href="../../overview/introduction-to-eclipse-che/">Documentation</a></li> |
| <li><a href="./">Importing untrusted TLS certificates to Che</a></li> |
| </ul> |
| </nav> |
| <div class="edit-this-page"><a href="https://github.com/eclipse/che-docs/edit/master/modules/installation-guide/pages/importing-untrusted-tls-certificates-old.adoc">Edit this Page</a></div> |
| </div> |
| <div class="content"> |
| <aside class="toc sidebar" data-title="Contents" data-levels="2"> |
| <div class="toc-menu"></div> |
| </aside> |
| <article class="doc"> |
| <h1 class="page">Importing untrusted TLS certificates to Che</h1> |
| <div id="preamble"> |
| <div class="sectionbody"> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="admonitionblock note"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-note" title="Note"></i> |
| </td> |
| <td class="content"> |
| This obsolete method is kept for backward compatibility . See <a href="../importing-untrusted-tls-certificates/" class="page">Importing untrusted TLS certificates to Che</a> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Internal communications between Che components are, by default, encrypted with TLS. Communications of Che components with external services such as proxies, source code repositories, identity providers may require TLS tool. Those communications require the use of TLS certificates signed by trusted Certificate Authorities.</p> |
| </div> |
| <div class="paragraph"> |
| <p>When the certificates used by Che components or by an external service are signed by an untrusted CA it can be necessary to import the CA certificate in the Che installation, so that every Che component will consider them as signed by a trusted CA.</p> |
| </div> |
| <div class="paragraph"> |
| <p>Typical cases that may require this addition are:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>when the underlying Kubernetes cluster uses TLS certificates signed by a CA that is not trusted,</p> |
| </li> |
| <li> |
| <p>when Che server or workspace components connect to external services such as Keycloak or a Git server that use TLS certificates signed by an untrusted CA.</p> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <p>To store those certificates, Che uses a dedicated ConfigMap. Its default name is <code>ca-certs</code> but Che allows configuring its name.</p> |
| </div> |
| <div class="admonitionblock note"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-note" title="Note"></i> |
| </td> |
| <td class="content"> |
| <div class="paragraph"> |
| <p>On OpenShift, when |
| the cluster contains cluster-wide trusted CA certificates added through the <a href="https://docs.openshift.com/container-platform/4.4/networking/configuring-a-custom-pki.html#nw-proxy-configure-object_configuring-a-custom-pki">cluster-wide-proxy configuration</a>, Che Operator detects them and automatically injects them into this ConfigMap:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>Che automatically labels the ConfigMap with the <code>config.openshift.io/inject-trusted-cabundle="true"</code> label.</p> |
| </li> |
| <li> |
| <p>Based on this annotation, OpenShift automatically injects the cluster-wide trusted CA certificates inside the <code>ca-bundle.crt</code> key of ConfigMap</p> |
| </li> |
| </ul> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="_at_che_installation_time"><a class="anchor" href="#_at_che_installation_time"></a>At Che installation time</h2> |
| <div class="sectionbody"> |
| <div class="ulist"> |
| <div class="title">Prerequisites</div> |
| <ul> |
| <li> |
| <p>The <code>kubectl</code> tool is available.</p> |
| </li> |
| <li> |
| <p>You are ready to create <code>CheCluster</code> custom resource.</p> |
| </li> |
| </ul> |
| </div> |
| <div class="olist arabic"> |
| <div class="title">Procedure</div> |
| <ol class="arabic"> |
| <li> |
| <p>Save the certificates you need to import, to a local file system.</p> |
| <div class="admonitionblock caution"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-caution" title="Caution"></i> |
| </td> |
| <td class="content"> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>Certificate files are typically stored as Base64 ASCII files, such as <code>.pem</code>, <code>.crt</code>, <code>.ca-bundle</code>. But, they can also be binary-encoded, for example, as <code>.cer</code> files. All Secrets that hold certificate files should use the Base64 ASCII certificate rather than the binary-encoded certificate.</p> |
| </li> |
| <li> |
| <p>Che already uses some reserved file names to automatically inject certificates into the ConfigMap, so you should avoid using the following reserved file names to save your certificates:</p> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><code>ca-bundle.crt</code></p> |
| </li> |
| <li> |
| <p><code>ca.crt</code></p> |
| </li> |
| </ul> |
| </div> |
| </li> |
| </ul> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </li> |
| <li> |
| <p>Create a new ConfigMap with the required TLS certificates:</p> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ kubectl create configmap ca-certs --from-file=<em><certificate-file-path></em> -n=eclipse-che</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>To apply more than one certificate, add another <code>--from-file=<em><certificate-file-path></em></code> option to the above command.</p> |
| </div> |
| </li> |
| <li> |
| <p>During the installation process, when creating the <code>CheCluster</code> custom resource, configure the right name for the created ConfigMap.</p> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="paragraph"> |
| <p>For a Che <a href="https://docs.openshift.com/container-platform/latest/operators/understanding/olm-what-operators-are.html">Operator</a> deployment, |
| ensure you add the <code>spec.server.ServerTrustStoreConfigMapName</code> field with the name of the ConfigMap, to the <code>CheCluster</code> Custom Resource you will create during the installation:</p> |
| </div> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="highlightjs highlight nowrap"><code class="language-yaml hljs" data-lang="yaml">spec: |
| server: |
| ... |
| spec.server.ServerTrustStoreConfigMapName: ca-certs</code></pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="paragraph"> |
| <p>For a Che <a href="https://helm.sh/">Helm Chart</a> deployment, ensure you override the <code>global.tls.serverTrustStoreConfigMapName</code> Helm Chart property with the name of the ConfigMap when installing the Che Helm Chart. For this you should add the following arguments to the Helm command line:</p> |
| </div> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">--set global.tls.serverTrustStoreConfigMapName=ca-certs</pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| </li> |
| </ol> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="_on_already_running_che_installations"><a class="anchor" href="#_on_already_running_che_installations"></a>On already-running Che installations</h2> |
| <div class="sectionbody"> |
| <div class="ulist"> |
| <div class="title">Prerequisites</div> |
| <ul> |
| <li> |
| <p>The <code>kubectl</code> tool is available.</p> |
| </li> |
| <li> |
| <p>You should first gather the name of the ConfigMap used to import certificates:</p> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="paragraph"> |
| <p>On instances of Che deployed with the Che <a href="https://docs.openshift.com/container-platform/latest/operators/understanding/olm-what-operators-are.html">Operator</a>, |
| retrieve the name of the ConfigMap by reading the <code>spec.server.ServerTrustStoreConfigMapName</code> <code>CheCluster</code> Custom Resource property:</p> |
| </div> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get checluster eclipse-che -n eclipse-che -o jsonpath={.spec.server.serverTrustStoreConfigMapName}</pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="paragraph"> |
| <p>On instances of Che deployed with the Che <a href="https://helm.sh/">Helm Chart</a> deployment, retrieve the name of the ConfigMap by reading the <code>global.tls.serverTrustStoreConfigMapName</code> property from the Helm Chart:</p> |
| </div> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ helm get values che --all --output json | jq -r '.global.tls.serverTrustStoreConfigMapName'</pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="admonitionblock note"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-note" title="Note"></i> |
| </td> |
| <td class="content"> |
| <div class="paragraph"> |
| <p>If the existing installation did not define any name for the ConfigMap, just use <code>ca-certs</code>.</p> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </li> |
| </ul> |
| </div> |
| <div class="olist arabic"> |
| <div class="title">Procedure</div> |
| <ol class="arabic"> |
| <li> |
| <p>Save the certificates you need to import, to a local file system.</p> |
| <div class="admonitionblock caution"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-caution" title="Caution"></i> |
| </td> |
| <td class="content"> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>Certificate files are typically stored as Base64 ASCII files, such as <code>.pem</code>, <code>.crt</code>, <code>.ca-bundle</code>. But, they can also be binary-encoded, for example, as <code>.cer</code> files. All Secrets that hold certificate files should use the Base64 ASCII certificate rather than the binary-encoded certificate.</p> |
| </li> |
| <li> |
| <p>Che already uses some reserved file names to automatically inject certificates into the ConfigMap, so you should avoid using the following reserved file names to save your certificates:</p> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><code>ca-bundle.crt</code></p> |
| </li> |
| <li> |
| <p><code>ca.crt</code></p> |
| </li> |
| </ul> |
| </div> |
| </li> |
| </ul> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </li> |
| <li> |
| <p>Add the required TLS certificates in the ConfigMap:</p> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ kubectl create configmap <em><config-map-name></em> --from-file=<em><certificate-file-path></em> -n=eclipse-che -o yaml --dry-run | kubectl apply -f -</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>To apply more than one certificate, add another <code>--from-file=<em><certificate-file-path></em></code> option to the above command.</p> |
| </div> |
| </li> |
| <li> |
| <p>Configure the Che installation to use the ConfigMap:</p> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="paragraph"> |
| <p>For a Che <a href="https://docs.openshift.com/container-platform/latest/operators/understanding/olm-what-operators-are.html">Operators</a> deployment:</p> |
| </div> |
| <div class="olist arabic"> |
| <ol class="arabic"> |
| <li> |
| <p>Edit the <code>spec.server.ServerTrustStoreConfigMapName</code> <code>CheCluster</code> Custom Resource property to match the name of the ConfigMap:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl patch checluster/eclipse-che -n eclipse-che --type=json -p '[{"op": "replace", "path": "/spec/server/serverTrustStoreConfigMapName", "value": "<config-map-name>"}]'</pre> |
| </div> |
| </div> |
| </li> |
| </ol> |
| </div> |
| </div> |
| </div> |
| <div class="exampleblock"> |
| <div class="content"> |
| <div class="paragraph"> |
| <p>For a Che <a href="https://helm.sh/">Helm Chart</a> deployment:</p> |
| </div> |
| <div class="olist arabic"> |
| <ol class="arabic"> |
| <li> |
| <p>Clone the <a href="https://github.com/eclipse-che/che-server">Che server</a> project.</p> |
| </li> |
| <li> |
| <p>Go to the <code>deploy/kubernetes/helm/che</code> directory.</p> |
| </li> |
| <li> |
| <p>Update the name of the configMap Che will use, by editing the <code>global.tls.serverTrustStoreConfigMapName</code> Helm Chart property to match the created or updated ConfigMap:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ helm upgrade che -n eclipse-che --set global.tls.serverTrustStoreConfigMapName=<config-map-name> \ |
| --set global.ingressDomain=<em><kubernetes-cluster-domain></em> .</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>When using Minikube to run Che, substitute <em><kubernetes-cluster-domain></em> with <code>$(minikube ip).nip.io</code>.</p> |
| </div> |
| </li> |
| </ol> |
| </div> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Restart the Che Operator, the Che server and Keycloak to load the new certificates:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl rollout restart -n eclipse-che deployment/che-operator |
| $ kubectl rollout restart -n eclipse-che deployment/keycloak |
| $ kubectl rollout restart -n eclipse-che deployment/che</pre> |
| </div> |
| </div> |
| <div class="admonitionblock note"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-note" title="Note"></i> |
| </td> |
| <td class="content"> |
| <div class="paragraph"> |
| <p>Restarting the Che components is not required anymore on Che |
| v7.20.0 |
| and higher.</p> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| </li> |
| </ol> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="_verification_at_the_che_installation_level"><a class="anchor" href="#_verification_at_the_che_installation_level"></a>Verification at the Che installation level</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>If you added the certificates without error, the Che server starts and obtains Keycloak configuration over https. Otherwise here is a list of things to verify:</p> |
| </div> |
| <div class="olist arabic"> |
| <ol class="arabic"> |
| <li> |
| <p>In case of a Che <a href="https://docs.openshift.com/container-platform/latest/operators/understanding/olm-what-operators-are.html">Operator</a> deployment, the <code>CheCluster</code> attribute <code>serverTrustStoreConfigMapName</code> value matches the name of the ConfigMap. Get the value using the following command :</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get -o json checluster/eclipse-che -n eclipse-che | jq .spec.server.serverTrustStoreConfigMapName</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Che Pod Volumes list contains one Volume that uses the ConfigMap as data-source. To get the list of Volumes of the Che Pod:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get pod -o json <em><che-pod-name></em> -n eclipse-che | jq .spec.volumes</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Che mounts certificates in folder <code>/public-certs/</code> of the Che server container. This command returns the list of files in that folder:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl exec -t <em><che-pod-name></em> -n eclipse-che -- ls /public-certs/</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>In the Che server logs there is a line for every certificate added to the Java truststore, including configured Che certificates.</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl logs <em><che-pod-name></em> -n eclipse-che |
| (...) |
| Found a custom cert. Adding it to java trust store based on /usr/lib/jvm/java-1.8.0/jre/lib/security/cacerts |
| (...)</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Che server Java truststore contains the certificates. The certificates SHA1 fingerprints are among the list of the SHA1 of the certificates included in the truststore returned by the following command:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl exec -t <em><che-pod-name></em> -n eclipse-che -- keytool -list -keystore /home/user/cacerts |
| Your keystore contains 141 entries |
| |
| (...)</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>To get the SHA1 hash of a certificate on the local filesystem:</p> |
| </div> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ openssl x509 -in <em><certificate-file-path></em> -fingerprint -noout |
| SHA1 Fingerprint=3F:DA:BF:E7:A7:A7:90:62:CA:CF:C7:55:0E:1D:7D:05:16:7D:45:60</pre> |
| </div> |
| </div> |
| </li> |
| </ol> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="_verification_at_the_workspace_level"><a class="anchor" href="#_verification_at_the_workspace_level"></a>Verification at the workspace level</h2> |
| <div class="sectionbody"> |
| <div class="olist arabic"> |
| <ol class="arabic"> |
| <li> |
| <p>Start a workspace, get the namespace in which it has been created, and wait for it to be started</p> |
| </li> |
| <li> |
| <p>Get the name of the workspace Pod with the following command:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get pods -o=jsonpath='{.items[0].metadata.name}' -n <em><workspace namespace></em> | grep '^workspace.*'</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Get the name of the Theia IDE container in the workspace Pod with the following command:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get -o json pod <em><workspace pod name></em> -n <em><workspace namespace></em> | \ |
| jq -r '.spec.containers[] | select(.name | startswith("theia-ide")).name'</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Look for a <code>ca-certs</code> ConfigMap that should have been created inside the workspace namespace:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get cm ca-certs <em><workspace namespace></em></pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Check that the entries in the <code>ca-certs</code> ConfigMap contain all the additional entries you added in the certificate ConfigMap at the Che installation level, in addition to the <code>ca-bundl.crt</code> entry which is a reserved one:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get cm ca-certs -n <em><workspace namespace></em> -o json | jq -r '.data | keys[]' |
| ca-bundle.crt |
| manually-added-certificate.crt</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Make sure that the <code>ca-certs</code> ConfigMap has been added as a volume in the workspace Pod:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get -o json pod <em><workspace pod name></em> -n eclipse-che | \ |
| jq '.spec.volumes[] | select(.configMap.name == "ca-certs")' |
| { |
| "configMap": { |
| "defaultMode": 420, |
| "name": "ca-certs" |
| }, |
| "name": "che-self-signed-certs" |
| }</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Confirm that the volume has been mounted into containers, especially in the Theia IDE container:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl get -o json pod <em><workspace pod name></em> -n <em><workspace namespace></em> | \ |
| jq '.spec.containers[] | select(.name == "<em><theia ide container name></em>").volumeMounts[] | select(.name == "che-self-signed-certs")' |
| { |
| "mountPath": "/public-certs", |
| "name": "che-self-signed-certs", |
| "readOnly": true |
| }</pre> |
| </div> |
| </div> |
| </li> |
| <li> |
| <p>Inspect <code>/public-certs</code> folder on the Theia IDE container and check that its contents match the list of entries in the <code>ca-certs</code> ConfigMap:</p> |
| <div class="listingblock white-space-pre"> |
| <div class="content"> |
| <pre class="nowrap">$ kubectl exec <em><workspace pod name></em> -c <em><theia ide container name></em> -n <em><workspace namespace></em> -- ls /public-certs |
| ca-bundle.crt |
| manually-added-certificate.crt</pre> |
| </div> |
| </div> |
| </li> |
| </ol> |
| </div> |
| </div> |
| </div> |
| </article> |
| </div> |
| </main> |
| </div> |
| <footer class="footer"> |
| <div><a href="https://www.eclipse.org" target="_blank">Eclipse Foundation</a> | |
| <a href="https://www.eclipse.org/legal/privacy.php" target="_blank">Privacy Policy</a> | |
| <a href="https://www.eclipse.org/legal/termsofuse.php" target="_blank">Terms of Use</a> | |
| <a href="https://www.eclipse.org/legal/epl-2.0/" target="_blank">Eclipse Public License</a> | |
| <a href="https://www.eclipse.org/legal" target="_blank">Legal Resources</a></div> |
| </footer> |
| |
| <script src="../../../_/js/site.js"></script> |
| <script async src="../../../_/js/vendor/highlight.js"></script> |
| </body> |
| </html> |
