Cloud Firewall:[Public preview] TLS inspection

CentOS / Alibaba Cloud Linux / Anolis / Red Hat

# 1. Copy the certificate file
cp <certificate filename> /etc/pki/ca-trust/source/anchors/

# 2. Update the trust store
sudo update-ca-trust

# 3. Verify the installation (certificate content should appear in the output)
cat /etc/ssl/certs/ca-bundle.crt

Ubuntu

# 1. Copy the certificate file
cp <certificate filename> /usr/local/share/ca-certificates/

# 2. Update the trust store
sudo update-ca-certificates

# 3. Verify the installation (certificate content should appear in the output)
cat /etc/ssl/certs/ca-certificates.crt

SUSE

# 1. Copy the certificate file
cp <certificate filename> /etc/pki/trust/anchors

# 2. Update the trust store
sudo c_rehash .

# 3. Verify the installation (certificate information should appear in the output)
sudo trust list --filter=ca-anchors |grep -C 2 <certificate CN>

Fedora / Fedora CoreOS

# 1. Copy the certificate file
sudo cp <certificate filename> /etc/pki/ca-trust/source/anchors/

# 2. Update the trust store
sudo update-ca-trust extract

# 3. Verify the installation (certificate information should appear in the output)
sudo trust list --filter=ca-anchors |grep -C 2 <certificate CN>

Windows

After splitting:

1. Install the certificate: Right-click the certificate file and click Install Certificate. Follow these steps: Click Next to complete the import.

   1	2	3

2. View the installed certificates: In Command Prompt, run certmgr.msc to open Certificate Manager.

   

Container Service for Kubernetes (ACK)

When outbound traffic originates from pods in an ACK cluster, you must install the PCA certificate inside each pod because containers are isolated from the host. If the nodes themselves initiate HTTPS requests (for example, to pull public images), also install the certificate on the nodes.

Install the certificate on nodes

Log on to each node and run the following commands:

# 1. Copy the certificate file
cp <certificate filename> /etc/pki/ca-trust/source/anchors/

# 2. Update the trust store
sudo update-ca-trust

# 3. Verify the installation (certificate content should appear in the output)
cat /etc/ssl/certs/ca-bundle.crt

# 4. Restart containerd to apply the changes
sudo systemctl restart containerd

Install the certificate in pods

1. Create a secret in the target cluster with the certificate file content as the secret value. For detailed steps, see Manage secrets. You can also create the secret by using the following kubectl command. Replace ca_chain.crt with your actual certificate filename.

      kubectl create secret generic cfw-pca-cert \
        --from-file=ca_chain.crt=./ca_chain.crt \
        -n default

   

2. For a Deployment, add the following to its YAML file:

   1. In the spec.template.spec.containers field, add the following to mount the certificate and update the trust store. Replace secretName with the secret name from the previous step (cfw-pca-cert):

      volumes:
              - name: custom-ca-volume
                secret:
                  secretName: cfw-pca-cert   
      volumeMounts:
              - name: custom-ca-volume
                mountPath: /etc/ssl/custom
                readOnly: true  

   2. Still under spec.template.spec.containers, add a startup command.

      Note

      The following example uses CentOS in the container and is for reference only. Adjust the commands based on your operating system and workload requirements.

      command:
                - "/bin/sh"
                - "-c"
                - |
                  # 1. Install curl
                  echo "Installing curl......"
                  yum install -y curl
      
                  # 2. Verify certificate mount; replace ca_chain.crt with your actual filename
                  if [ ! -f /etc/ssl/custom/ca_chain.crt ]; then
                    echo "ERROR: Certificate file not found!"
                    exit 1
                  fi
      
                  # 3. Inject certificate per CentOS steps
                  echo "Copying certificate to anchors directory..."
                  cp /etc/ssl/custom/ca_chain.crt /etc/pki/ca-trust/source/anchors/
      
                  echo "Updating CA trust store..."
                  update-ca-trust        
      
                  # 4. Keep Pod running
                  echo "Pod ready for manual testing. Use 'kubectl exec' to test further."
                  sleep infinity