<p>It turns out that <code>/etc/ssl/cert.pem</code> is the bundle scanned by <code>apk</code> to verify a repo behind HTTPS, so the following works:</p>

<pre><code>wget our.cert.server.com/CA.crt
cat CA.crt &gt;&gt; /etc/ssl/cert.pem
sed -i 's,http://dl-cdn.alpinelinux.org/alpine,https://nexus-endpoint.company.com/repository/alpine-proxy,' /etc/apk/repositories
apk update
</code></pre>

CC BY-SA 4.0
2019-11-04T20:42:21.280Z
2019-11-04T20:42:21.280Z
LLlAMnYP
<p>I am in a corporate environment behind a gateway that does DPI and often replaces the TLS certificate of most online resources with our corporate certificate. Many of our developers use images based on alpine linux to do their work and at peak times the network gets overloaded, builds crash because of failed <code>apk add</code> commands and whatnot. So I set up an instance of Nexus with a caching proxy for alpine apk packages.</p>

<p>However, the Nexus is served behind TLS with a certificate signed by our internal CA which is obviously not in the list of default trusted CAs. Without doing <code>apk add ca-certificates</code> I cannot do an <code>update-ca-certificates</code> and without trusting our internal CA I cannot do <code>apk add</code>. I would like to avoid exposing Nexus via insecure HTTP.</p>

<p>I can do a <code>wget our.cert.server.com/CA.crt</code>, but <code>/etc/ssl/certs</code> is empty and behavior doesn't change when I create <code>/etc/ssl/certs/ca-certificate(s).crt</code> and copy the certificate into there.</p>

<p>How can I (or our developers) bootstrap alpine images for work in our network without too much of a change to our workflow?</p>

<ssl><provisioning><repository><alpine>
How do I bootstrap an alpine image to work with a private repo proxy behind TLS?
LLlAMnYP
# How do I bootstrap an alpine image to work with a private repo proxy behind TLS?

(Asked by: username_0 on 2019-11-04)

I am in a corporate environment behind a gateway that does DPI and often replaces the TLS certificate of most online resources with our corporate certificate. Many of our developers use images based on alpine linux to do their work and at peak times the network gets overloaded, builds crash because of failed `apk add` commands and whatnot. So I set up an instance of Nexus with a caching proxy for alpine apk packages.

However, the Nexus is served behind TLS with a certificate signed by our internal CA which is obviously not in the list of default trusted CAs. Without doing `apk add ca-certificates` I cannot do an `update-ca-certificates` and without trusting our internal CA I cannot do `apk add`. I would like to avoid exposing Nexus via insecure HTTP.

I can do a `wget our.cert.server.com/CA.crt`, but `/etc/ssl/certs` is empty and behavior doesn't change when I create `/etc/ssl/certs/ca-certificate(s).crt` and copy the certificate into there.

How can I (or our developers) bootstrap alpine images for work in our network without too much of a change to our workflow?

**Tags:** ssl, provisioning, repository, alpine


---

## 1 answers

### Answer by username_0 on 2019-11-04. Score: 2

It turns out that /etc/ssl/cert.pem is the bundle scanned by apk to verify a repo behind HTTPS, so the following works:
wget our.cert.server.com/CA.crt
cat CA.crt >> /etc/ssl/cert.pem
sed -i 's,http://dl-cdn.alpinelinux.org/alpine,https://nexus-endpoint.company.com/repository/alpine-proxy,' /etc/apk/repositories
apk update


---

