HMKnapp / cfci

drop-in shell script for docker builds behind corporate firewall. also works standalone in WSL or minGW.

Corporate Firewall Certificate Importer

Self-signed corporate MITM certificates often stop you cold, especially when it comes to working with Docker or WSL or simply Git Bash if you’re forced to use Windows.

I made this drop-in script with the aim that it just works. You can immediately start productive work instead of trying to filter out bits of useful information from an ocean of outdated and irrelevant information provided by people who are just guessing.

E.g. you

• are stuck when building a docker image, because the corporate firewall prevents you from installing packages or even querying the mirror list

• cannot update your local git installation with git-update-git-for-windows

• cannot use repositories with https mirrors in WSL

What does CFCI do?

CFCI connects to a list of hosts, downloads their certificate chain, splits them into individual certificates, and imports them into the system’s certificate store.

1. Why several hosts?

   Because experience tells me that the same firewall may inject different self-signed certificates for different hosts. The list contained in the script is a list of commonly used hosts which should cover most cases.

2. What if my supercorp requires a proxy in addition to its firewall?

   CFCI detects if a proxy is set via ENV and will fetch the proxy’s certificates and import them.

Usage

On your local machine

Just run it

bash cfci.sh

You can specify custom hosts if you need to

bash cfci.sh nexus.globocorp.local gitlab.globocorp.local

Docker

If your docker image builds fail because you get tortured with unsafe MITM pseudo-security nonsense, put CFCI in the beginning of your Dockerfile.

Run CFCI before you connect anywhere

FROM rockylinux:9

COPY cfci.sh /cfci.sh
RUN bash /cfci.sh

RUN yum update -y
RUN yum upgrade -y

Note	If your security team is especially talented you may get an unsafe legacy renegotiation error on some hosts. In this case you can use a modified openssl.cnf before CFCI is called.

Add custom openssl.cnf for SSL legacy renegotiation

FROM rockylinux:9

COPY openssl.cnf /etc/pki/tls/openssl.cnf
COPY cfci.sh /cfci.sh
RUN bash /cfci.sh

Known to work with

1. Rocky Linux / RHEL / Fedora

2. Ubuntu (WSL)

3. Windows (MinGW)

4. Possibly many more