Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Alternative method for adding internal certificates to Chrome and Firefox #1852

Merged
merged 4 commits into from
May 18, 2023
Merged

Alternative method for adding internal certificates to Chrome and Firefox #1852

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
23fe658
Update README.md
luisfcorreia May 18, 2023
a0478ce
Update README.md
luisfcorreia May 18, 2023
63e43f9
Merge branch 'trunk' into patch-11
luisfcorreia May 18, 2023
d28b594
Update README.md
luisfcorreia May 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1074,7 +1074,51 @@ RUN mkdir -p -m755 /home/seluser/.pki/nssdb \ #create nssdb folder
&& pk12util -d sql:/home/seluser/.pki/nssdb -i client_cert.p12 -W password_of_clent_cert # client certificate install
```
This way the certificates will be installed and the node will start automatically as before.
___

## Alternative method: Add certificates to existing Selenium based images for browsers

As an alternative, you can add youe certificate files to existing Selenium images. This practical example
diemol marked this conversation as resolved.
Show resolved Hide resolved
assumes you have a known image to use as a build image and have a way to publish new images to your local
docker registry.

This also assumes you are using a redhat based image as *build* _with_ your internal CA already added.
(default location for rocky linux is /etc/pki/ca-trust/source/anchors/YOUR_CA.pem)
diemol marked this conversation as resolved.
Show resolved Hide resolved

(tested working 2023-05-17, based on images from Selenium 4.9.1 release)
diemol marked this conversation as resolved.
Show resolved Hide resolved

Example for Chromium based browsers (Chrome and Edge):
```
# Get a standard image for creating nssdb file
FROM rockylinux:8.6 as build
RUN yum install -y nss-tools
RUN mkdir -p -m755 /seluser/.pki/nssdb \
&& certutil -d sql:/seluser/.pki/nssdb -N --empty-password \
&& certutil -d sql:/seluser/.pki/nssdb -A -t "C,," -n YOUR_CA -i /etc/pki/ca-trust/source/anchors/YOUR_CA.pem \
&& chown -R 1200:1201 /seluser

# Start from Selenium image and add relevant files from build image
FROM selenium/node-chrome:4.9.1
diemol marked this conversation as resolved.
Show resolved Hide resolved
USER root
COPY --from=build /seluser/ /home/seluser/
USER seluser
```

Example for Firefox:
```
# Get a standard image for working on
FROM rockylinux:8.6 as build
RUN mkdir -p "/distribution" "/certs" && \
cp /etc/pki/ca-trust/source/anchors/YOUR_CA*.pem /certs/ && \
echo '{ "policies": { "Certificates": { "Install": ["/opt/firefox-latest/YOUR_CA.pem"] }} }' >"/distribution/policies.json"

# Start from Selenium image and add relevant files from build image
FROM selenium/node-firefox:4.9.1
diemol marked this conversation as resolved.
Show resolved Hide resolved
USER root
COPY --from=build /certs /opt/firefox-latest
COPY --from=build /distribution /opt/firefox-latest/distribution
USER seluser
```
___

## Debugging
Expand Down