topic Changing SSL Certificate on the MineMeld Docker container in General Topics

Changing SSL Certificate on the MineMeld Docker container

nbilal — Thu, 07 Dec 2017 05:45:20 GMT

Team,

Does anyone have some guidance on changing out the SSL certificates on the MineMeld Docker container? Should we modify the dockerfile to include a COPY command? Is there a way to just shunt it in via mapping an additional VOLUME during the "docker run"?

Thanks again for an awesome tool!

Regards,

Nasir

Re: Changing SSL Certificate on the MineMeld Docker container

xhoms — Thu, 07 Dec 2017 08:01:13 GMT

Hi @nbilal,

I just build a new docker image based on the jtschichold/minemeld one.

Create a new folder and place there the certificate components (minemeld.cer, minemeld.pem). In that same folder create a file named 'Dockerfile' with the following contents:

FROM jtschichold/minemeld
ADD minemeld.cer /etc/nginx
ADD minemeld.pem /etc/nginx

Then run the command 'docker build -t myminemeld .' in that folder. A new docker image called 'myminemeld' will be created with your certificates in it.

Re: Changing SSL Certificate on the MineMeld Docker container

nbilal — Thu, 07 Dec 2017 17:31:55 GMT

Thanks @xhoms!

This worked perfectly. I didn't realize playing with the container filesystem was so easy! For reference for others, here's the process I went through to get the new certs on, build the new container, and launch it with the appropriate options:

# SCP THE PKCS12 BSTAR WILDCARD CERT TO DOCKER HOST (docker host is 10.1.1.1)
scp wildcard.domain.com.p12 user@10.1.1.1:~/wildcard.domain.com.p12

# EXTRACT KEY AND CERT FILES FROM THE PKCS12 (assuming that it’s password-protected with ‘paloalto')
openssl pkcs12 -in wildcard.domain.com.p12 -out minemeld.cer -clcerts -nokeys -passin pass:paloalto
openssl pkcs12 -in wildcard.domain.com.p12 -out minemeld.pem -nocerts -nodes -passin pass:paloalto

# CREATE A DOCKERFILE TO REBUILD MINEMELD CONTAINER WITH THE NEW CERT INCLUDED
vi Dockerfile

FROM jtschichold/minemeld
ADD minemeld.cer /etc/nginx
ADD minemeld.pem /etc/nginx

# BUILD THE NEW DOCKER CONTAINER
docker build -t my_minemeld .

# RUN THE NEW DOCKER CONTAINER
docker run -dit --name mm_01 --restart unless-stopped --tmpfs /run -v /opt/minemeld-docker/:/opt/minemeld/local -p 443:443/tcp my_minemeld