{"action":"created","issue":{"url":"https://api.github.com/repos/travis-ci/enterprise-installation/issues/8","labels_url":"https://api.github.com/repos/travis-ci/enterprise-installation/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/travis-ci/enterprise-installation/issues/8/comments","events_url":"https://api.github.com/repos/travis-ci/enterprise-installation/issues/8/events","html_url":"https://github.com/travis-ci/enterprise-installation/issues/8","id":65224991,"number":8,"title":"Custom root certificate","user":{"login":"MitchK","id":2472064,"avatar_url":"https://avatars.githubusercontent.com/u/2472064?v=3","gravatar_id":"","url":"https://api.github.com/users/MitchK","html_url":"https://github.com/MitchK","followers_url":"https://api.github.com/users/MitchK/followers","following_url":"https://api.github.com/users/MitchK/following{/other_user}","gists_url":"https://api.github.com/users/MitchK/gists{/gist_id}","starred_url":"https://api.github.com/users/MitchK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MitchK/subscriptions","organizations_url":"https://api.github.com/users/MitchK/orgs","repos_url":"https://api.github.com/users/MitchK/repos","events_url":"https://api.github.com/users/MitchK/events{/privacy}","received_events_url":"https://api.github.com/users/MitchK/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-30T14:29:32Z","updated_at":"2015-04-27T15:12:47Z","closed_at":null,"body":"Hi,\r\n\r\nWe are currently trying to add our GHE root certificate to ```te-main```. We followed this instructions: https://github.com/travis-ci/enterprise-installation#specifying-a-custom-root-certificate\r\n\r\nWhich format and file extension should this certificate have?\r\nWe tried to place our internal root certificate for GHE in this file (encoded as ASCII PEM): \r\n\r\n```\r\n/etc/travis/ssl/ca-certificates/my_root_certificate.crt\r\n```\r\n\r\nand restarted Travis:\r\n\r\n```\r\nsudo te start\r\n```\r\n\r\nAll requests against GHE (e.g. for setting commit status) still fail:\r\n\r\n```\r\n$ tail -f /var/log/travis.log\r\n...\r\n[2015-03-30T14:26:47+0000][travis-tasks:tasks] 2015-03-30T14:26:47Z 2816 TID-418 WARN: type=github_status build=127 repo=travis/example-nodejs-1 error=not_updated url=https://github.mycompany.corp/repos/travis/example-nodejs-1/statuses/e2af25e1ea4f2bf01a70cbb0a9385b6977caf613 message=GH request failed\r\n[2015-03-30T14:26:47+0000][travis-tasks:tasks] verb:               :head\r\n[2015-03-30T14:26:47+0000][travis-tasks:tasks] url:                /api/v3/applications/5dd4868f986cffcd3f45/tokens/41b270a1591c45ed5e32ca800f61486ce0b01aa1?client_id=[removed]&client_secret=[removed]\r\n[2015-03-30T14:26:47+0000][travis-tasks:tasks] headers:            {\"Authorization\"=>[removed]}\r\n[2015-03-30T14:26:47+0000][travis-tasks:tasks] error:              Faraday::SSLError: certificate verify failed\r\n[2015-03-30T14:26:47+0000][travis-tasks:tasks] payload:            {\"state\":\"success\",\"description\":\"The Travis CI build passed\",\"target_url\":\"https://travis-ci.mycompany.corp/travis/example-nodejs-1/builds/127\",\"context\":\"continuous-integration/travis-ci\"}\r\n```\r\n\r\nThanks for your help"},"comment":{"url":"https://api.github.com/repos/travis-ci/enterprise-installation/issues/comments/96696212","html_url":"https://github.com/travis-ci/enterprise-installation/issues/8#issuecomment-96696212","issue_url":"https://api.github.com/repos/travis-ci/enterprise-installation/issues/8","id":96696212,"user":{"login":"MitchK","id":2472064,"avatar_url":"https://avatars.githubusercontent.com/u/2472064?v=3","gravatar_id":"","url":"https://api.github.com/users/MitchK","html_url":"https://github.com/MitchK","followers_url":"https://api.github.com/users/MitchK/followers","following_url":"https://api.github.com/users/MitchK/following{/other_user}","gists_url":"https://api.github.com/users/MitchK/gists{/gist_id}","starred_url":"https://api.github.com/users/MitchK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MitchK/subscriptions","organizations_url":"https://api.github.com/users/MitchK/orgs","repos_url":"https://api.github.com/users/MitchK/repos","events_url":"https://api.github.com/users/MitchK/events{/privacy}","received_events_url":"https://api.github.com/users/MitchK/received_events","type":"User","site_admin":false},"created_at":"2015-04-27T15:12:47Z","updated_at":"2015-04-27T15:12:47Z","body":"Hi @svenfuchs ,\r\n\r\nWhen we restart Travis Main using ```te start```, then the certificates are wiped out, I am sure that the behaviours is intented. So weit, so gut.\r\n\r\nSo after restarting ```te-main```, it should be reproducible:\r\n\r\n1. Add ```myawesomeca.crt``` to host machine's directory: \r\n```\r\nme@host:~$ sudo ls -la /etc/travis/ssl/ca-certificates/\r\ntotal 12\r\ndrwxr-xr-x 2 root root 4096 Apr 27 14:42 .\r\ndrwxr-xr-x 4 root root 4096 Mar 30 14:53 ..\r\n-rw-r--r-- 1 root root  989 Apr 27 14:42 myawesomeca.crt\r\n```\r\n\r\n2. Restart ```te-main``` using ```sudo te-start```\r\n3. Create a pull request, trigger a build.\r\n\r\n=> No status is reported.\r\n=> Travis logs show: \r\n```\r\n[2015-04-27T14:57:25+0000][travis-tasks:tasks] error:              Faraday::SSLError: certificate verify failed\r\n```\r\n\r\n4. SSH to ```te-main````\r\n5. Check if certificate is in ```/usr/share/ca-certificates``` on ```te-main```\r\n```\r\nroot@te-main:~# ls -la /usr/share/ca-certificates/\r\ntotal 24\r\ndrwxr-xr-x   4 root root  4096 Apr 27 14:51 .\r\ndrwxr-xr-x 133 root root  4096 Apr 27 14:51 ..\r\ndrwxr-xr-x   2 root root 12288 Dec  4 18:01 mozilla\r\nlrwxrwxrwx   1 root root    44 Apr 27 14:51 myawesomeca.crt -> /etc/travis/ssl/ca-certificates/myawesomeca.crt\r\ndrwxr-xr-x   2 root root  4096 Dec  4 18:01 spi-inc.org\r\n```\r\n6. Run ```update-ca-certificates```\r\n\r\n=> No certificate is imported\r\n=> GHE requests still fail\r\n\r\n\r\nFix:\r\n\r\n7. Soft link the .crt certificate to ```/usr/local/share/ca-certificates/myawesomeca.crt```:\r\n```\r\nroot@te-main:~# ln -s /etc/travis/ssl/ca-certificates/myawesomeca.crt /usr/local/share/ca-certificates/myawesomeca.crt\r\nroot@te-main:~# ls -la /usr/local/share/ca-certificates/\r\ntotal 8\r\ndrwxrwsr-x  2 root staff 4096 Apr 27 14:57 .\r\ndrwxr-xr-x 11 root root  4096 Apr 27 14:57 ..\r\nlrwxrwxrwx  1 root staff   44 Apr 27 14:57 sapnetca.crt -> /etc/travis/ssl/ca-certificates/myawesomeca.crt\r\n```\r\n\r\n8. Run ```update-ca-certificates```\r\n\r\n=> Certificate is recognised by update-ca-certificates\r\n=> Requests are successful immediately\r\n\r\nIt seems that ```/usr/share/ca-certificates``` is the wrong directory to store the certificates. What do you think?"}}