opencode-container/certs/README.md

Custom CA certificates

Place any additional CA certificates needed to reach internal HTTPS services in this directory, as PEM files with a .crt or .pem extension:

certs/
├── README.md
├── company-root.crt
└── company-intermediate.crt

This file also guarantees the directory exists in a fresh clone. The build copies certs/ into the image and runs update-ca-certificates, so it fails if the directory is missing.

How they are installed

Dockerfile copies this directory to:

/usr/local/share/ca-certificates

and runs:

update-ca-certificates

The resulting system CA bundle is also exposed to Node.js through:

NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

so both system tools and Node.js applications trust the added certificates.

Rules

• Certificates are baked in at build time. The runtime container does not install certificates from the host, so there is no need to mount this directory into the container.

• Rebuild after any change:

  ./build.sh --no-cache --update
  

• Only public CA certificates belong here. Never commit private material (*.key, *.p12, *.pfx) — everything matched here is copied into the image verbatim.

• Files must be PEM encoded. Convert DER with:

  openssl x509 -inform der -in cert.der -out cert.crt
  

Troubleshooting

If a certificate seems ignored, check that it parses and that the build picked it up:

openssl x509 -in company-root.crt -noout -subject -issuer -dates

A build that prints warnings from update-ca-certificates usually means a file in this directory is not a valid PEM certificate. The permissive .crt/.pem extensions mean a stray text file or archive will be picked up and rejected.