Trusted CA certificates for TLS/HTTPS traffic

Your infrastructure might be configured to intercept outbound and HTTPS traffic. Instead of passing the original certificate through, it re-signs it with its own certificate. To do this, you might use a device such as a corporate L7/TLS-inspecting firewall, an egress proxy, or a network security appliance.

If this is the case, then you must configure the following environment variable

FABRICATE_CA_CERT_FILE=<path to certificate file>

For example:

FABRICATE_CA_CERT_FILE=/custom-ca.crt

If you do not set this, then outbound HTTPS calls from Fabricate fail certificate verification, because the Fabricate container's default OS trust store does not contain the device certificate.

To enable Fabricate to use the certificate:

1. Get the CA certificate that the intercepting device presents. This might be a .crt or .pem file that the network team already has, or you might be able to export it from the device.
2. Mount the certificate file into the Fabricate container at any path. For example, you might use a Docker volume in docker-compose.yml:

volumes:
    - ./my-corporate-ca.crt:/custom-ca.crt

1. Set FABRICATE_CA_CERT_FILE to point to that path: FABRICATE_CA_CERT_FILE=/custom-ca.crt
2. Restart the container.