Skip to main content
In many enterprise environments, internal certificate authorities (CAs) or self-signed TLS certificates are used—for example for internal APIs, private container registries, or package repositories. The same is required when a firewall or proxy with TLS inspection breaks up outbound traffic and re-signs it with its own certificate, for example on the way to the model provider. For applications in the VARIOS AI container to trust these certificates, mount the CA certificate from the host into the container. This configuration adds your CA certificate to the container’s trust store. The container can then establish TLS connections to servers signed by your internal CA.

​
Prerequisites

  • The CA certificate is in PEM format (a text file starting with -----BEGIN CERTIFICATE-----).
  • The file contains exactly one certificate.
  • Use the .crt extension for the file name inside the container.
If the certificate is in DER format (for example a .cer file), convert it with openssl x509 -inform der -in internal-ca.cer -out internal-ca.crt.

​
Configuration

The PHP container does not start as root by default. update-ca-certificates requires root privileges. In your docker-compose.yml, adjust the PHP container as shown below and mount the CA certificate as a volume. Remove any existing command on the PHP service. Startup is handled by the customized entrypoint.
The path left of the colon (./certs/internal-ca.crt) is where the certificate is stored on the host, relative to your docker-compose.yml. Adjust it to match your environment.The path right of the colon is inside the container. The /usr/local/share/ca-certificates/ directory stays the same regardless of the host operating system.
If you need several CA certificates, for example a root CA and an intermediate CA, mount each certificate on its own line with a unique file name:

​
Apply

Save your docker-compose.yml and restart the containers:
If the containers are already running, restarting the PHP container is sufficient—for example, docker compose up -d php.

​
How It Works

On PHP container startup, the customized entrypoint runs these steps automatically—you do not need to execute anything manually:
  1. The CA certificate is mounted from the host to /usr/local/share/ca-certificates/.
  2. The container starts as root (user: "0:0") so that update-ca-certificates can add the certificate to the system-wide trust store.
  3. /scripts/entrypoint.sh switches to the application user (PUID/PGID) and starts VARIOS AI via /scripts/run.sh.

​
Result

After the container starts:
  • The CA certificate is available inside the container.
  • The certificate is registered in the system-wide trust store.
  • Applications in the container can establish TLS connections to servers signed by this CA.

​
Typical Use Cases

  • Using an internal corporate CA
  • Accessing internal APIs with self-signed certificates
  • Trust for private container registries or package repositories
  • Outbound traffic through a firewall or proxy with TLS inspection