Install certificate to store on container

Question

I'm working on migrating my existing Sitecore 10.1.1 site into containers. My code requires a cert to be available in the local certificate store on the container. It seems like the Sitecore ID container is already doing this. I tried to figure out how this certificate gets into the store so I can use same approach. Does anyone know how this gets into the certificate store on container?

Answer 1

Assuming you have a certificate in pfx format and you know its password (if the certificate is password protected), you can install it in the image of your container when you build it, copying the certificate in the image (with its password) and installing it with the Import-PfxCertificate powershell command.

You can do this in the dockerfile build specs of your image, adding the following commands:

# Steps to copy certificate pfx file and its password in image
COPY .\cert.pfx C:\cert.pfx
COPY .\cert.password.txt C:\cert.password.txt

...

# Step to import Pfx certificate in local machine root certificate store
RUN $password = (Get-Content -Path C:\cert.password.txt) | ConvertTo-SecureString -AsPlainText -Force; `
$cert = Import-PfxCertificate -Password $password -CertStoreLocation Cert:\LocalMachine\root -FilePath C:\cert.pfx

Paths in the example above might differ in your host build instance.

UPDATE (based on additional details shared in comments):

Like Mark wrote in his comment, Identity Server allows to use a certificate stored in an environment variable, instead of being stored in storage or in a file (see the \sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml configuration file of an Identity Server instance to see the different available configuration options).

If your solution doesn't support these alternative certificate storage solutions and you have different certificates per environments, you could execute the Import-PfxCertificate command in your container at runtime, extending the entrypoint script of your image (or creating one if the image doesn't have an entrypoint yet).

You could use the same approach of providing the certificate raw data and password using environment variables. You will need to write the certificate raw data in a pfx file in the container, since the Import-PfxCertificate command takes the path of the certificate file as input parameter only.

This is an example of code to add to an entrypoint script that would take care of writing a certificate in the file system from an environment variable and installing it:

...
"${env:CUSTOM_CERT_PFX_DATA}" | Out-File C:\cert.pfx -Force
$password = "{env:CUSTOM_CERT_PFX_PASSWORD}" | ConvertTo-SecureString -AsPlainText -Force
$cert = Import-PfxCertificate -Password $password -CertStoreLocation Cert:\LocalMachine\root -FilePath C:\cert.pfx
...

Where CUSTOM_CERT_PFX_DATA would be an environment variable to provide the pfx certificate data and CUSTOM_CERT_PFX_PASSWORD would be an environment variable to provide its password.