<p>So in my environment i am using Docker and Kubernete ,now i have to import a certificate in Pods Java Keystore .
But my Container running as a <code>NON-ROOT</code> user .When i am trying to import the certificate to Java Keystore its failing as to accessing Java Keystore user have to be root user only.</p>
<pre><code>keytool -importcert -alias keycloakTest -keystore $JAVA_HOME/lib/security/cacerts -file $WSO2_SERVER_HOME/keycloak.crt -storepass changeit -noprompt
</code></pre>
<p>Now How i can import the certificate into Java trust store? Currently i am doing this manually but later i have to do this through <code>DockerFile</code></p>
<pre><code>COPY /carFiles/keycloak.crt  $WSO2_SERVER_HOME/
CMD keytool -importcert -alias keycloakTest -keystore $JAVA_HOME/lib/security/cacerts -file $WSO2_SERVER_HOME/keycloak.crt -storepass changeit -noprompt
</code></pre>
<p>In Kubernete Pods Java run as a <code>root</code> user only?</p>
<p>Edit</p>
<p>I made changes in Docker File something like this</p>
<pre><code>COPY /carFiles/keycloak.crt /opt
CMD keytool -importcert -alias keycloakTest -keystore $JAVA_HOME/lib/security/cacerts -file /opt/keycloak.crt -storepass changeit -noprompt
</code></pre>
<p>So from Pods Shell i am able to see certificate Copied to <code>/opt</code> directory but next <code>CMD</code> command wont able to add the certificate into the truststore of java</p>
<p><a href="https://i.stack.imgur.com/fqmMI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fqmMI.png" alt="enter image description here" /></a></p>
<p>Enter key or you will be logged out any time after 101 min.</p>
<pre><code>spec:
      volumes:
        - name: certs
          emptyDir: {}
      initContainers:
        - name: {{ .Chart.Name }}-create-keystore-truststore
          securityContext:
            runAsNonRoot: true
            runAsUser: 100
          image: &gt;-
            &lt;HOST&gt;/foapi-tools:20.0.1

 command:
            - sh
            - '-c'
            - &gt;
             # Import Keycloak server certificate into truststore

              # Extract host name from ckey URL

              KEYCLOAK_HOST=$(echo
              &quot;https://&lt;HOST&gt;/auth&quot; | sed
              's|[^/]*//\([^/]*\)/.*|\1|')

              echo &quot;Importing server cert of '${KEYCLOAK_HOST}'...&quot;

              openssl s_client -connect ${KEYCLOAK_HOST}:443 2&gt;/dev/null
              &lt;/dev/null | openssl x509 &gt; keycloak.crt

              ls -lat /certs/truststore;
          workingDir: /certs/truststore
          resources:
            limits:
              cpu: 200m
              memory: 200Mi
            requests:
              cpu: 200m
              memory: 100Mi
          volumeMounts:
            - name: certs
              mountPath: /certs/truststore
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
</code></pre>

Subodh Joshi
<p>As per the shared information, you are using WSO2 MI and trying to generate a token from the Mediation sequence with Keycloak. In such a case, it is not required to add the Keycloak's cert to the <code>cacerts</code> of the JDK. You can make use of the WSO2 MI's <code>client-truststore.jks</code> to import the certs.</p>
<p>To access the <code>/opt</code> path, the user needs root permission. As WSO2 MI itself contains a truststore and not requires any root permissions to import the certs, you can simply import the Keycloak's TLS public cert in there. Given is a sample <code>Dockerfile</code> to import the certs</p>
<pre><code>COPY /carFiles/keycloak.crt $WSO2_SERVER_HOME/repository/resources/security/
RUN keytool -importcert -alias keycloakTest -keystore $WSO2_SERVER_HOME/repository/resources/security/client-truststore.jks -file $WSO2_SERVER_HOME/repository/resources/security/keycloak.crt -storepass changeit -noprompt
</code></pre>
<blockquote>
<p>Note: Replace the <code>CMD</code> with the <code>RUN</code> command, as you are trying to import the certs to the truststore as part of building the images. And not setting that command as an entrypoint to start the containers.</p>
</blockquote>
<p>Further, if you have a certifier chain, you have to include all (root, intermediate, and leaf certs) in the truststore. Importing only one of them will result again in an SSL Handshake error.</p>
