This article only relates to the On-Premises installation of COYO. For security reasons, we are unable to save self-signed certificates in our Cloud.
To use LDAP with SSL, the certificate of your LDAP server for COYO should be known. If you have an officially signed certificate, you don’t need to use the following customizations.
Enter self-signed certificate in the JVM of the backend container
To import the self-signed certificate of your LDAP server into the Java keystore, you need the keystore cacerts used by COYO. It’s easiest to copy this from the backend container:
docker cp $(docker ps | grep "backend" | cut -d" " -f1):/usr/lib/jvm/zulu15-ca-amd64/lib/security/cacerts /home/coyo/cacerts
Please note: /srv/coyo/cacerts is an example. Customize this to suit the directory containing your keystore cacerts.
This requires the keytool to be installed on the server where you execute the following command:
keytool -import -alias <alias_for_entry> -file <cert.pem> -keystore cacerts -storepass
changeit -trustcacerts -noprompt
Note: If the keytool can’t be executed because a Java JDK is missing, you will be shown a corresponding command to install it.
Next, check whether the certificate has been imported correctly:
keytool -list -v -keystore cacerts -alias <alias_for_entry> -storepass <keystore_pw>
Finally, add the keystore cacerts into the docker-compose.yml in coyo-backend as a volume:
Please note: /home/coyo/cacerts is an example. Customize this to suit the directory containing your keystore cacerts.
Please bear in mind that docker-compose.yml is replaced when COYO is updated! Document the change in case you ever need to make it again.