Description

According to https://quarkus.io/guides/native-and-ssl#the-truststore-path,

the root certificates are fixed at image build time [...] when the defaults need to be changed, these system properties must be provided at image build time

But trust settings can be environmental. Examples:

• A corporate proxy may do MITM inspection of HTTPS traffic and re-sign with an organizational CA
• An organizational CA may be used on-premise
• An OpenShift cluster can provide service certificate with its own internal CA

Making this a build-time-only option limits the ability of Quarkus apps to connect to services whose certificates are signed by an environment-specific CA.

It would be helpful if operators could provide an environmental trust store at runtime.

Ideally PEM files could be trusted directly to avoid the need to use keytool at runtime. PEM files can come from a number of sources, especially within OpenShift:

• OpenShift can inject its cluster-specific service CA certificate into an annotated ConfigMap.
• Operators may add add organizational CAs to a ConfigMap.
• Cluster admins can configure the proxy settings to include environmental CAs. This can be injected to a specially labelled ConfigMap.

A runtime option to load trusted CAs from multiple PEM files would greatly ease Quarkus' use in environments where custom CA settings are a requirement.

Implementation ideas

No response