How to use local/private CA cert?

Using Ghost
1

Hi guys.

It does not seem that Ghost default docker image can make use of private/local certificates - can it?

If so - how do you do it?

thanks, L.

1 Like
2

To double check what you’re referring to - are you meaning Ghost trusting private/local certs when making outbound https calls? (i.e. making requests to internal/private local endpoints) Or are you referring to Ghost itself performing TLS termination with private/local certs?

For the former - it should be possible to get Node to trust local certs via the NODE_EXTRA_CA_CERTS env var. Or, you can make a custom docker image adding your cert to the container cert store, and configure node to use the system store with --use-system-ca.

For the latter, typically it’s better to put Ghost behind a reverse proxy like Caddy or Nginx that’s responsible for the TLS termination.

1 Like
3

Something what I’d like to think is a must - when… well, doing anything locally, privately - a secure email server. I filed a bug/enhancement request as well.

thanks, I’ll try those - still, best would to have Ghost accommodate for this.

4

Have you looked at maildev with mail__options__host: maildev ? That’s been pretty helpful for me when testing.

5

If you’re talking about outbound requests (the issue that NODE_EXTRA_CA_CERTS/system-ca is intended to solve), there’s not much Ghost can do directly without a significant amount of custom code. That’s the whole reason those underlying node options exist :sweat_smile:

1 Like
6

Where do we learn about those “underlying” option - I read the docs & sroogled for it but failed to find any mention of it, any mention of private CAs except for database(just below which is email part). Is there more of it which similarly can be critical?

7

The Node.js command line options documentation is a great place to find all of the various ways in which you can customize the underlying Node.js runtime. There’s a lot there, but the links I shared previously point to the specific options you can set for your use-case.

Ghost’s documentation itself doesn’t mention this because it’s not Ghost-specific; that said, we can probably find a place in Ghost’s documentation for these sorts of system-level customization notes that point to the underlying Node options. The existing database tls documentation is there because the db connection library mysql2 uses Node’s tls connection library directly and can’t leverage system-level settings like the ca certs/system trust store.

1 Like