Repository: exasol/integration-test-docker-environment (language: python)

Issue:
Create or inject SSL Certificates into the Docker-DB
# Background

- To test the SSL Hostname Verification in pyexasol it is necessary to create SSL certificates with the name of the docker container of the docker-db, because this name can be used in the docker-network to find the docker-db container via DNS and as this is valid target for SSL Hostname Verification
- An example for this Setup can be found here https://github.com/tkilias/pyexasol/tree/pyexasol_ssl_test/pyexasol_ssl_test

# Acceptance Criteria

- We can create a SSL Certificate with the name of the docker-db container
- We can inject an external SSL Certificate


Discussion / hints:
I suggest the following approach:

1. Add one more option for `spawn-test-environment.sh` called `--create-certificates`.
2. If this option is set, generate CA certificate, Exasol server server certificate, private key. Place it into specific directory in the container. 
3. (optional) Add CA certificate as "trusted" to test container.
4. Copy certificate files to volume used for Exasol docker container. Update `EXAConf`.
5. Run Exasol in Docker.

Final result:

- Exasol in Docker starts with auto-generated server certificate in place. Certificate hostname should match the name of container.
- Generated certificates are available for tests to read & test.

Thank you.
On the second thought, maybe we do not even need a custom option.

Instead we can always generate a self-signed certificate for test environments. The only difference between custom generated certificates and "default" certificates generated by Exasol will be a hostname entry.

All the existing tests will keep working. I don't see any potential downsides.

Fix patch:
diff --git a/docker_db_config_template/6.2/EXAConf b/docker_db_config_template/6.2/EXAConf
index 594394a79..e1fada73d 100644
--- a/docker_db_config_template/6.2/EXAConf
+++ b/docker_db_config_template/6.2/EXAConf
@@ -23,9 +23,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /path/to/ssl.crt
-    CertKey = /path/to/ssl.key
-    CertAuth = /path/to/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/docker_db_config_template/7.0.0/EXAConf b/docker_db_config_template/7.0.0/EXAConf
index e08774c45..7b9496ace 100644
--- a/docker_db_config_template/7.0.0/EXAConf
+++ b/docker_db_config_template/7.0.0/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/docker_db_config_template/7.1.0/EXAConf b/docker_db_config_template/7.1.0/EXAConf
index 3307d9fed..2bb80a3f9 100644
--- a/docker_db_config_template/7.1.0/EXAConf
+++ b/docker_db_config_template/7.1.0/EXAConf
@@ -32,9 +32,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
     # Options to verify certificates: none, optional, required
     CertVerify = none
     # Domain name in the certifcate
diff --git a/setup.py b/setup.py
index 9d5f238ea..54563a9be 100644
--- a/setup.py
+++ b/setup.py
@@ -62,7 +62,8 @@
                                                 'docker_db_config/7.1.0/*',
                                                 'docker_db_config/7.1.1/*',
                                                 'docker_db_config/7.1.2/*',
-                                                'docker_db_config/7.1.3/*']}
+                                                'docker_db_config/7.1.3/*',
+                                                'test_container_config/*']}
 
 install_requires = \
 ['click>=7.0',


Test patch:
diff --git a/exasol_integration_test_docker_environment/cli/commands/spawn_test_environment.py b/exasol_integration_test_docker_environment/cli/commands/spawn_test_environment.py
index 509a4dcd5..c3ef6dcc0 100644
--- a/exasol_integration_test_docker_environment/cli/commands/spawn_test_environment.py
+++ b/exasol_integration_test_docker_environment/cli/commands/spawn_test_environment.py
@@ -47,7 +47,8 @@ def spawn_test_environment(
         output_directory: str,
         temporary_base_directory: str,
         workers: int,
-        task_dependencies_dot_file: str):
+        task_dependencies_dot_file: str,
+        create_certificates: bool):
     """
     This command spawn a test environment with a docker-db container and a connected test-container.
     The test-container is reachable by the database for output redirects of UDFs.
@@ -85,7 +86,8 @@ def spawn_test_environment(
         no_test_container_cleanup_after_failure=False,
         no_database_cleanup_after_success=True,
         no_database_cleanup_after_failure=False,
-        is_setup_database_activated=not deactivate_database_setup
+        is_setup_database_activated=not deactivate_database_setup,
+        create_certificates=create_certificates
     )
     success, task = run_task(task_creator, workers, task_dependencies_dot_file)
     if not success:
diff --git a/exasol_integration_test_docker_environment/cli/options/test_environment_options.py b/exasol_integration_test_docker_environment/cli/options/test_environment_options.py
index 26d0b45c5..cd93beb19 100644
--- a/exasol_integration_test_docker_environment/cli/options/test_environment_options.py
+++ b/exasol_integration_test_docker_environment/cli/options/test_environment_options.py
@@ -18,7 +18,9 @@
                  help="""Docker DB Image Version against which the tests should run."""),
     click.option('--docker-db-image-name', type=str, default="""exasol/docker-db""",
                  show_default=True,
-                 help="""Docker DB Image Name against which the tests should run.""")
+                 help="""Docker DB Image Name against which the tests should run."""),
+    click.option('--create-certificates/--no-create-certificates', default=False,
+                 help="""Creates and injects SSL certificates to the Docker DB container.""")
 ]
 
 external_db_options = [
diff --git a/exasol_integration_test_docker_environment/docker_db_config/6.2.0/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/6.2.0/EXAConf
index 594394a79..e1fada73d 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/6.2.0/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/6.2.0/EXAConf
@@ -23,9 +23,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /path/to/ssl.crt
-    CertKey = /path/to/ssl.key
-    CertAuth = /path/to/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/6.2.1/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/6.2.1/EXAConf
index 594394a79..e1fada73d 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/6.2.1/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/6.2.1/EXAConf
@@ -23,9 +23,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /path/to/ssl.crt
-    CertKey = /path/to/ssl.key
-    CertAuth = /path/to/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/6.2/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/6.2/EXAConf
index 594394a79..e1fada73d 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/6.2/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/6.2/EXAConf
@@ -23,9 +23,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /path/to/ssl.crt
-    CertKey = /path/to/ssl.key
-    CertAuth = /path/to/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.0/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.0/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.0/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.0/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.1/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.1/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.1/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.1/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.10/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.10/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.10/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.10/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.11/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.11/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.11/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.11/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.12/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.12/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.12/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.12/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.13/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.13/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.13/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.13/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.14/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.14/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.14/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.14/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.2/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.2/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.2/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.2/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.3/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.3/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.3/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.3/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.4/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.4/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.4/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.4/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.5/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.5/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.5/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.5/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.6/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.6/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.6/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.6/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.7/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.7/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.7/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.7/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.8/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.8/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.8/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.8/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.0.9/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.0.9/EXAConf
index e08774c45..7b9496ace 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.0.9/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.0.9/EXAConf
@@ -24,9 +24,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
 
 # Docker related options
 [Docker]
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.1.0/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.1.0/EXAConf
index 3307d9fed..2bb80a3f9 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.1.0/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.1.0/EXAConf
@@ -32,9 +32,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
     # Options to verify certificates: none, optional, required
     CertVerify = none
     # Domain name in the certifcate
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.1.1/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.1.1/EXAConf
index 3307d9fed..2bb80a3f9 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.1.1/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.1.1/EXAConf
@@ -32,9 +32,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
     # Options to verify certificates: none, optional, required
     CertVerify = none
     # Domain name in the certifcate
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.1.2/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.1.2/EXAConf
index 3307d9fed..2bb80a3f9 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.1.2/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.1.2/EXAConf
@@ -32,9 +32,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
     # Options to verify certificates: none, optional, required
     CertVerify = none
     # Domain name in the certifcate
diff --git a/exasol_integration_test_docker_environment/docker_db_config/7.1.3/EXAConf b/exasol_integration_test_docker_environment/docker_db_config/7.1.3/EXAConf
index 3307d9fed..2bb80a3f9 100644
--- a/exasol_integration_test_docker_environment/docker_db_config/7.1.3/EXAConf
+++ b/exasol_integration_test_docker_environment/docker_db_config/7.1.3/EXAConf
@@ -32,9 +32,9 @@
 # SSL options
 [SSL]
     # The SSL certificate, private key and CA for all EXASOL services
-    Cert = /exa/etc/ssl/ssl.crt
-    CertKey = /exa/etc/ssl/ssl.key
-    CertAuth = /exa/etc/ssl/ssl.ca
+    Cert = {{ certificate_dir }}/cert.crt
+    CertKey = {{ certificate_dir }}/cert.key
+    CertAuth = {{ certificate_dir }}/rootCA.crt
     # Options to verify certificates: none, optional, required
     CertVerify = none
     # Domain name in the certifcate
diff --git a/exasol_integration_test_docker_environment/lib/data/docker_volume_info.py b/exasol_integration_test_docker_environment/lib/data/docker_volume_info.py
new file mode 100644
index 000000000..4a77f69ff
--- /dev/null
+++ b/exasol_integration_test_docker_environment/lib/data/docker_volume_info.py
@@ -0,0 +1,15 @@
+from exasol_integration_test_docker_environment.lib.base.info import Info
+
+
+class DockerVolumeInfo(Info):
+
+    def __str__(self):
+        return f'DockerVolumeInfo: \n' \
+               f'volume_name="{self.volume_name}"\n' \
+               f'reused={self.reused}\n' \
+               f'mount_point={self.mount_point}'
+
+    def __init__(self, volume_name: str, mount_point: str, reused: bool = False):
+        self.volume_name = volume_name
+        self.reused = reused
+        self.mount_point = mount_point
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/abstract_spawn_test_environment.py b/exasol_integration_test_docker_environment/lib/test_environment/abstract_spawn_test_environment.py
index 2111357c4..27fb9e677 100644
--- a/exasol_integration_test_docker_environment/lib/test_environment/abstract_spawn_test_environment.py
+++ b/exasol_integration_test_docker_environment/lib/test_environment/abstract_spawn_test_environment.py
@@ -1,5 +1,5 @@
 from pathlib import Path
-from typing import Generator, Tuple
+from typing import Generator, Tuple, Optional
 
 import luigi
 
@@ -10,6 +10,7 @@
 from exasol_integration_test_docker_environment.lib.data.database_credentials import DatabaseCredentialsParameter
 from exasol_integration_test_docker_environment.lib.data.database_info import DatabaseInfo
 from exasol_integration_test_docker_environment.lib.data.docker_network_info import DockerNetworkInfo
+from exasol_integration_test_docker_environment.lib.data.docker_volume_info import DockerVolumeInfo
 from exasol_integration_test_docker_environment.lib.data.environment_info import EnvironmentInfo
 from exasol_integration_test_docker_environment.lib.test_environment.database_setup.populate_data import \
     PopulateEngineSmallTestDataToDatabase
@@ -30,6 +31,7 @@ class AbstractSpawnTestEnvironment(DockerBaseTask,
                                    GeneralSpawnTestEnvironmentParameter,
                                    DatabaseCredentialsParameter):
     environment_name = luigi.Parameter()  # type: str
+    create_certificates = luigi.BoolParameter()
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -133,12 +135,23 @@ def collect_environment_info_variables(self, test_container_name, test_environme
     def _start_database(self, attempt) \
             -> Generator[BaseTask, BaseTask, Tuple[DockerNetworkInfo, DatabaseInfo, bool, ContainerInfo]]:
         network_info = yield from self._create_network(attempt)
+        ssl_volume_info = None
+        if self.create_certificates:
+            ssl_volume_info = yield from self._create_ssl_certificates()
         database_info, test_container_info = \
-            yield from self._spawn_database_and_test_container(network_info, attempt)
+            yield from self._spawn_database_and_test_container(network_info, ssl_volume_info, attempt)
         is_database_ready = yield from self._wait_for_database(
             database_info, test_container_info, attempt)
         return network_info, database_info, is_database_ready, test_container_info
 
+    def _create_ssl_certificates(self) -> DockerVolumeInfo:
+        ssl_info_future = yield from self.run_dependencies(self.create_ssl_certificates())
+        ssl_info = self.get_values_from_future(ssl_info_future)
+        return ssl_info
+
+    def create_ssl_certificates(self):
+        raise AbstractMethodException()
+
     def _create_network(self, attempt):
         network_info_future = yield from self.run_dependencies(self.create_network_task(attempt))
         network_info = self.get_values_from_future(network_info_future)
@@ -149,7 +162,9 @@ def create_network_task(self, attempt: int):
 
     def _spawn_database_and_test_container(self,
                                            network_info: DockerNetworkInfo,
+                                           certificate_volume_info: Optional[DockerVolumeInfo],
                                            attempt: int):
+        certificate_volume_name = certificate_volume_info.volume_name if certificate_volume_info is not None else None
         database_and_test_container_info_future = \
             yield from self.run_dependencies({
                 TEST_CONTAINER: \
@@ -158,8 +173,9 @@ def _spawn_database_and_test_container(self,
                         test_container_name=self.test_container_name,
                         network_info=network_info,
                         ip_address_index_in_subnet=1,
+                        certificate_volume_name=certificate_volume_name,
                         attempt=attempt),
-                DATABASE: self.create_spawn_database_task(network_info, attempt)
+                DATABASE: self.create_spawn_database_task(network_info, certificate_volume_info, attempt)
             })
         database_and_test_container_info = \
             self.get_values_from_futures(database_and_test_container_info_future)
@@ -169,6 +185,7 @@ def _spawn_database_and_test_container(self,
 
     def create_spawn_database_task(self,
                                    network_info: DockerNetworkInfo,
+                                   certificate_volume_info: Optional[DockerVolumeInfo],
                                    attempt: int):
         raise AbstractMethodException()
 
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/create_ssl_certificates_task.py b/exasol_integration_test_docker_environment/lib/test_environment/create_ssl_certificates_task.py
new file mode 100644
index 000000000..e105996c2
--- /dev/null
+++ b/exasol_integration_test_docker_environment/lib/test_environment/create_ssl_certificates_task.py
@@ -0,0 +1,129 @@
+import docker
+import luigi
+import pkg_resources
+from jinja2 import Template
+
+from exasol_integration_test_docker_environment.lib.base.docker_base_task import DockerBaseTask
+from exasol_integration_test_docker_environment.lib.data.docker_volume_info import DockerVolumeInfo
+from exasol_integration_test_docker_environment.lib.test_environment.analyze_test_container import \
+    DockerTestContainerBuild
+from exasol_integration_test_docker_environment.lib.test_environment.docker_container_copy import \
+    copy_script_to_container
+
+CERTIFICATES_MOUNT_PATH = "/certificates"
+
+
+class CreateSSLCertificatesTask(DockerBaseTask):
+    environment_name = luigi.Parameter()
+    test_container_name = luigi.Parameter()
+    docker_runtime = luigi.OptionalParameter(None, significant=False)
+    db_container_name = luigi.Parameter(significant=False)
+    network_name = luigi.Parameter()
+    reuse = luigi.BoolParameter(False, significant=False)
+    no_cleanup_after_success = luigi.BoolParameter(False, significant=False)
+    no_cleanup_after_failure = luigi.BoolParameter(False, significant=False)
+    volume_name = luigi.Parameter()
+
+    def run_task(self):
+        self.volume_info = None
+        if self.reuse:
+            self.logger.info("Try to reuse volume %s", self.volume_name)
+            try:
+                self.volume_info = self.get_volume_info(reused=True)
+            except Exception as e:
+                self.logger.warning(f"Tried to reuse volume {self.volume_name}, but got Exeception {e}. "
+                                    "Fallback to create new volume.")
+        if self.volume_info is None:
+            self.volume_info = self.create_docker_volume()
+            self.create_certificate()
+
+        self.return_object(self.volume_info)
+
+    def register_required(self):
+        self.test_container_image_future = \
+            self.register_dependency(self.create_child_task(task_class=DockerTestContainerBuild))
+
+
+    def get_volume_info(self, reused: bool) -> DockerVolumeInfo:
+        with self._get_docker_client() as docker_client:
+            volume_properties = docker_client.api.inspect_volume(self.volume_name)
+            if volume_properties['Name'] == self.volume_name:
+                return DockerVolumeInfo(volume_name=str(self.volume_name),
+                                        mount_point=volume_properties['Mountpoint'], reused=reused)
+
+    def create_docker_volume(self) -> DockerVolumeInfo:
+        self.remove_volume(self.volume_name)
+        with self._get_docker_client() as docker_client:
+            volume = docker_client.volumes.create(
+                name=self.volume_name,
+            )
+            volume_info = self.get_volume_info(reused=False)
+        return volume_info
+
+    def remove_volume(self, volume_name):
+        try:
+            with self._get_docker_client() as docker_client:
+                docker_client.volumes.get(volume_name).remove()
+                self.logger.info("Removed volume %s", volume_name)
+        except docker.errors.NotFound:
+            pass
+
+    def cleanup_task(self, success):
+        if (success and not self.no_cleanup_after_success) or \
+                (not success and not self.no_cleanup_after_failure):
+            try:
+                self.logger.info(f"Cleaning up volume %s:", self.volume_name)
+                self.remove_volume(self.volume_name)
+            except Exception as e:
+                self.logger.error(f"Error during removing volume %s: %s:", self.volume_name, e)
+
+    @property
+    def _construct_complete_host_name(self):
+        """
+        Example: 'db_container_exasol_test.db_network_exasol_test'
+        """
+        return f"{self.db_container_name}.{self.network_name}"
+
+    def create_certificate(self) -> None:
+        script_name = "create_certificates.sh"
+        template_str = pkg_resources.resource_string(
+            "exasol_integration_test_docker_environment",
+            f"test_container_config/{script_name}")  # type: bytes
+        template = Template(template_str.decode("utf-8"))
+        rendered_template = template.render(HOST_NAME=self._construct_complete_host_name,
+                                            cert_dir=CERTIFICATES_MOUNT_PATH)
+        test_container_image_info = \
+            self.get_values_from_futures(self.test_container_image_future)["test-container"]  # type:
+
+        volumes = {
+            self.volume_info.volume_name: {
+                "bind": CERTIFICATES_MOUNT_PATH,
+                "mode": "rw"
+            }
+        }
+
+        with self._get_docker_client() as docker_client:
+            try:
+                test_container = \
+                    docker_client.containers.create(
+                        image=test_container_image_info.get_target_complete_name(),
+                        name=self.test_container_name,
+                        network_mode=None,
+                        command="sleep infinity",
+                        detach=True,
+                        volumes=volumes,
+                        labels={"test_environment_name": self.environment_name, "container_type": "test_container"},
+                        runtime=self.docker_runtime
+                    )
+                test_container.start()
+                script_path_in_container = f"scripts/{script_name}"
+                copy_script_to_container(rendered_template, script_path_in_container, test_container)
+
+                self.logger.info("Creating certificates...")
+                exit_code, output = test_container.exec_run(f"bash {script_path_in_container}")
+                self.logger.info(output.decode('utf-8'))
+                if exit_code != 0:
+                    raise RuntimeError(f"Error creating certificates:'{output.decode('utf-8')}'")
+            finally:
+                test_container.stop()
+                test_container.remove()
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/docker_container_copy.py b/exasol_integration_test_docker_environment/lib/test_environment/docker_container_copy.py
index f3c7de340..9b15bce22 100644
--- a/exasol_integration_test_docker_environment/lib/test_environment/docker_container_copy.py
+++ b/exasol_integration_test_docker_environment/lib/test_environment/docker_container_copy.py
@@ -44,3 +44,12 @@ def copy(self, path_in_container:str):
         self.tar = None
         self.container.put_archive(path_in_container, self.file_like_object.getbuffer().tobytes())
         self.file_like_object = None
+
+
+def copy_script_to_container(script: str, script_path: str, container: Container):
+    """
+    Copy a script, given as string, to the container under specified location, relative to "/"
+    """
+    docker_container_copy = DockerContainerCopy(container)
+    docker_container_copy.add_string_to_file(script_path, script)
+    docker_container_copy.copy("/")
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_container.py b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_container.py
index 549e06aa7..05147d6d9 100644
--- a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_container.py
+++ b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_container.py
@@ -3,6 +3,8 @@
 
 import luigi
 import netaddr
+import pkg_resources
+from docker.models.containers import Container
 from docker.transport import unixconn
 
 from exasol_integration_test_docker_environment.lib.base.docker_base_task import DockerBaseTask
@@ -14,6 +16,8 @@
     DockerTestContainerBuild
 from exasol_integration_test_docker_environment.lib.test_environment.create_export_directory import \
     CreateExportDirectory
+from exasol_integration_test_docker_environment.lib.test_environment.docker_container_copy import \
+    copy_script_to_container
 
 
 class SpawnTestContainer(DockerBaseTask):
@@ -27,6 +31,7 @@ class SpawnTestContainer(DockerBaseTask):
     no_test_container_cleanup_after_success = luigi.BoolParameter(False, significant=False)
     no_test_container_cleanup_after_failure = luigi.BoolParameter(False, significant=False)
     docker_runtime = luigi.OptionalParameter(None, significant=False)
+    certificate_volume_name = luigi.OptionalParameter(None, significant=False)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -114,8 +119,14 @@ def _create_test_container(self, ip_address,
             tests_host_path: {
                 "bind": "/tests_src",
                 "mode": "rw"
-            }
+            },
         }
+        if self.certificate_volume_name is not None:
+            volumes[self.certificate_volume_name] = {
+                "bind": "/certificates",
+                "mode": "ro"
+            }
+
         with self._get_docker_client() as docker_client:
             docker_unix_sockets = [i for i in docker_client.api.adapters.values()
                                    if isinstance(i, unixconn.UnixHTTPAdapter)]
@@ -140,6 +151,7 @@ def _create_test_container(self, ip_address,
             network_aliases = self._get_network_aliases()
             docker_network.connect(test_container, ipv4_address=ip_address, aliases=network_aliases)
             test_container.start()
+            self.register_certificates(test_container)
             container_info = self.create_container_info(ip_address, network_aliases, network_info)
             return container_info
 
@@ -171,6 +183,20 @@ def _remove_container(self, container_name: str):
         except Exception as e:
             pass
 
+    def register_certificates(self, test_container: Container):
+        if self.certificate_volume_name is not None:
+            script_name = "install_root_certificate.sh"
+            script_str = pkg_resources.resource_string(
+                "exasol_integration_test_docker_environment",
+                f"test_container_config/{script_name}")  # type: bytes
+
+            script_location_in_container = f"scripts/{script_name}"
+            copy_script_to_container(script_str.decode("UTF-8"), script_location_in_container, test_container)
+
+            exit_code, output = test_container.exec_run(f"bash {script_location_in_container}")
+            if exit_code != 0:
+                raise RuntimeError(f"Error installing certificates:{output.decode('utf-8')}")
+
     def cleanup_task(self, success: bool):
         if (success and not self.no_test_container_cleanup_after_success) or \
                 (not success and not self.no_test_container_cleanup_after_failure):
@@ -179,3 +205,4 @@ def cleanup_task(self, success: bool):
                 self._remove_container(self.test_container_name)
             except Exception as e:
                 self.logger.error(f"Error during removing container %s: %s", self.test_container_name, e)
+
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_database.py b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_database.py
index 0106658de..5430cd7cb 100644
--- a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_database.py
+++ b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_database.py
@@ -24,6 +24,8 @@
 
 BUCKETFS_PORT = "6583"
 DB_PORT = "8888"
+CERTIFICATES_MOUNT_DIR = "/certificates"
+CERTIFICATES_DEFAULT_DIR = "/exa/etc/ssl/"
 
 
 class SpawnTestDockerDatabase(DockerBaseTask, DockerDBTestEnvironmentParameter):
@@ -33,6 +35,7 @@ class SpawnTestDockerDatabase(DockerBaseTask, DockerDBTestEnvironmentParameter):
     network_info = JsonPickleParameter(DockerNetworkInfo, significant=False)  # type: DockerNetworkInfo
     ip_address_index_in_subnet = luigi.IntParameter(significant=False)  # type: int
     docker_runtime = luigi.OptionalParameter(None, significant=False)  # type: str
+    certificate_volume_name = luigi.OptionalParameter(None, significant=False)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -91,13 +94,17 @@ def _create_database_container(self, db_ip_address: str, db_private_network: str
                 ports[f"{DB_PORT}/tcp"] = ('0.0.0.0', int(self.database_port_forward))
             if self.bucketfs_port_forward is not None:
                 ports[f"{BUCKETFS_PORT}/tcp"] = ('0.0.0.0', int(self.bucketfs_port_forward))
+            volumes = {db_volume.name: {"bind": "/exa", "mode": "rw"}}
+            if self.certificate_volume_name is not None:
+                volumes[self.certificate_volume_name] = {"bind": CERTIFICATES_MOUNT_DIR, "mode": "ro"}
+
             db_container = \
                 docker_client.containers.create(
                     image="%s" % (docker_db_image_info.get_source_complete_name()),
                     name=self.db_container_name,
                     detach=True,
                     privileged=True,
-                    volumes={db_volume.name: {"bind": "/exa", "mode": "rw"}},
+                    volumes=volumes,
                     network_mode=None,
                     ports=ports,
                     runtime=self.docker_runtime
@@ -110,7 +117,7 @@ def _create_database_container(self, db_ip_address: str, db_private_network: str
             return database_info
 
     def _get_network_aliases(self):
-        network_aliases = ["exasol_test_database", self.db_container_name]
+        network_aliases = ["exasol_test_database", "exasol-test-database", self.db_container_name]
         return network_aliases
 
     def _create_database_info(self, db_ip_address: str, reused: bool) -> DatabaseInfo:
@@ -223,6 +230,8 @@ def _upload_init_db_files(self,
 
     def _add_exa_conf(self, copy: DockerContainerCopy,
                       db_private_network: str):
+        certificate_dir = CERTIFICATES_MOUNT_DIR if self.certificate_volume_name is not None \
+                            else CERTIFICATES_DEFAULT_DIR
         template_str = pkg_resources.resource_string(
             "exasol_integration_test_docker_environment",
             f"{self.docker_db_config_resource_name}/EXAConf") # type: bytes
@@ -232,7 +241,8 @@ def _add_exa_conf(self, copy: DockerContainerCopy,
                                             image_version=self.docker_db_image_version,
                                             mem_size=self.mem_size,
                                             disk_size=self.disk_size,
-                                            name_servers=",".join(self.nameservers))
+                                            name_servers=",".join(self.nameservers),
+                                            certificate_dir=certificate_dir)
         copy.add_string_to_file("EXAConf", rendered_template)
 
     def _execute_init_db(self, db_volume: Volume, volume_preperation_container: Container):
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_docker_db.py b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_docker_db.py
index a9a601966..b04ce1fab 100644
--- a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_docker_db.py
+++ b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_docker_db.py
@@ -1,9 +1,14 @@
+from typing import Optional
+
 from exasol_integration_test_docker_environment.lib.data.container_info import ContainerInfo
 from exasol_integration_test_docker_environment.lib.data.database_info import DatabaseInfo
 from exasol_integration_test_docker_environment.lib.data.docker_network_info import DockerNetworkInfo
+from exasol_integration_test_docker_environment.lib.data.docker_volume_info import DockerVolumeInfo
 from exasol_integration_test_docker_environment.lib.data.environment_type import EnvironmentType
 from exasol_integration_test_docker_environment.lib.test_environment.abstract_spawn_test_environment import \
     AbstractSpawnTestEnvironment
+from exasol_integration_test_docker_environment.lib.test_environment.create_ssl_certificates_task import \
+    CreateSSLCertificatesTask
 from exasol_integration_test_docker_environment.lib.test_environment.database_waiters.wait_for_test_docker_database import \
     WaitForTestDockerDatabase
 from exasol_integration_test_docker_environment.lib.test_environment.parameter.docker_db_test_environment_parameter import \
@@ -11,6 +16,7 @@
 from exasol_integration_test_docker_environment.lib.test_environment.prepare_network_for_test_environment import \
     PrepareDockerNetworkForTestEnvironment
 from exasol_integration_test_docker_environment.lib.test_environment.spawn_test_database import SpawnTestDockerDatabase
+from exasol_integration_test_docker_environment.testing.utils import db_version_supports_custom_certificates
 
 
 class SpawnTestEnvironmentWithDockerDB(
@@ -20,10 +26,28 @@ class SpawnTestEnvironmentWithDockerDB(
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.db_container_name = f"""db_container_{self.environment_name}"""
+        self.certificate_volume_name = f"""certificates_{self.environment_name}"""
 
     def get_environment_type(self):
         return EnvironmentType.docker_db
 
+    def create_ssl_certificates(self):
+        if not db_version_supports_custom_certificates(self.docker_db_image_version):
+            raise ValueError("Minimal supported Database with custom certificates is '7.0.6'")
+        return \
+            self.create_child_task_with_common_params(
+                CreateSSLCertificatesTask,
+                environment_name=self.environment_name,
+                test_container_name=self.test_container_name,
+                db_container_name=self.db_container_name,
+                network_name=self.network_name,
+                docker_runtime=self.docker_runtime,
+                volume_name=self.certificate_volume_name,
+                reuse=self.reuse_database or self.reuse_test_container,
+                no_cleanup_after_success=self.no_database_cleanup_after_success or self.no_test_container_cleanup_after_success,
+                no_cleanup_after_failure=self.no_database_cleanup_after_failure or self.no_test_container_cleanup_after_failure,
+            )
+
     def create_network_task(self, attempt: int):
         return \
             self.create_child_task_with_common_params(
@@ -39,12 +63,16 @@ def create_network_task(self, attempt: int):
 
     def create_spawn_database_task(self,
                                    network_info: DockerNetworkInfo,
+                                   certificate_volume_info: Optional[DockerVolumeInfo],
                                    attempt: int):
+        certificate_volume_name = certificate_volume_info.volume_name if certificate_volume_info is not None else None
+
         return \
             self.create_child_task_with_common_params(
                 SpawnTestDockerDatabase,
                 db_container_name=self.db_container_name,
                 network_info=network_info,
+                certificate_volume_name=certificate_volume_name,
                 ip_address_index_in_subnet=0,
                 attempt=attempt
             )
diff --git a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_external_db.py b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_external_db.py
index bf04fde55..d979763ad 100644
--- a/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_external_db.py
+++ b/exasol_integration_test_docker_environment/lib/test_environment/spawn_test_environment_with_external_db.py
@@ -1,6 +1,9 @@
+from typing import Optional
+
 from exasol_integration_test_docker_environment.lib.data.container_info import ContainerInfo
 from exasol_integration_test_docker_environment.lib.data.database_info import DatabaseInfo
 from exasol_integration_test_docker_environment.lib.data.docker_network_info import DockerNetworkInfo
+from exasol_integration_test_docker_environment.lib.data.docker_volume_info import DockerVolumeInfo
 from exasol_integration_test_docker_environment.lib.data.environment_type import EnvironmentType
 from exasol_integration_test_docker_environment.lib.test_environment.abstract_spawn_test_environment import \
     AbstractSpawnTestEnvironment
@@ -31,7 +34,11 @@ def create_network_task(self, attempt: int):
                 network_name=self.network_name
             )
 
-    def create_spawn_database_task(self, network_info: DockerNetworkInfo, attempt: int):
+    def create_spawn_database_task(self, network_info: DockerNetworkInfo,
+                                   certificate_volume_info: Optional[DockerVolumeInfo], attempt: int):
+        if certificate_volume_info is not None:
+            raise ValueError("Certificate volume must be None when using external database")
+
         return \
             self.create_child_task_with_common_params(
                 SetupExternalDatabaseHost,
diff --git a/exasol_integration_test_docker_environment/test/test_test_env_reuse.py b/exasol_integration_test_docker_environment/test/test_test_env_reuse.py
index 02a3fa403..0cb53ee8f 100644
--- a/exasol_integration_test_docker_environment/test/test_test_env_reuse.py
+++ b/exasol_integration_test_docker_environment/test/test_test_env_reuse.py
@@ -9,6 +9,7 @@
 from exasol_integration_test_docker_environment.cli.common import set_docker_repository_config, generate_root_task
 from exasol_integration_test_docker_environment.testing import luigi_utils
 from exasol_integration_test_docker_environment.cli.options import test_environment_options
+from exasol_integration_test_docker_environment.testing.utils import check_db_version_from_env
 
 
 class TestContainerReuseTest(unittest.TestCase):
@@ -28,9 +29,9 @@ def setUp(self):
         print("docker_repository_name", self._docker_repository_name)
         luigi_utils.clean(self._docker_repository_name)
 
-        self.docker_db_version_parameter = test_environment_options.LATEST_DB_VERSION
-        if "EXASOL_VERSION" in os.environ and os.environ["EXASOL_VERSION"] != "default":
-            self.docker_db_version_parameter = os.environ["EXASOL_VERSION"]
+        db_version_from_env = check_db_version_from_env()
+        self.docker_db_version_parameter = db_version_from_env \
+            if db_version_from_env is not None else test_environment_options.LATEST_DB_VERSION
 
         self.setup_luigi_config()
 
diff --git a/exasol_integration_test_docker_environment/test/test_test_environment.py b/exasol_integration_test_docker_environment/test/test_test_environment.py
index a5a5d1e3c..0f9b4d457 100644
--- a/exasol_integration_test_docker_environment/test/test_test_environment.py
+++ b/exasol_integration_test_docker_environment/test/test_test_environment.py
@@ -21,7 +21,10 @@ def setUpClass(cls):
         # TODO cls.test_environment.clean_images()
         cls.docker_environment_name = cls.__name__
         cls.spawned_docker_test_environments = \
-            cls.test_environment.spawn_docker_test_environments(cls.docker_environment_name)
+            cls.test_environment.spawn_docker_test_environments(name=cls.docker_environment_name,
+                                                                additional_parameter=[
+                                                                    "--deactivate-database-setup"
+                                                                ])
 
     @classmethod
     def tearDownClass(cls):
diff --git a/exasol_integration_test_docker_environment/test/test_test_environment_certificate.py b/exasol_integration_test_docker_environment/test/test_test_environment_certificate.py
new file mode 100644
index 000000000..6531cf168
--- /dev/null
+++ b/exasol_integration_test_docker_environment/test/test_test_environment_certificate.py
@@ -0,0 +1,62 @@
+import unittest
+
+
+from exasol_integration_test_docker_environment.lib.docker import ContextDockerClient
+from exasol_integration_test_docker_environment.testing import utils
+from exasol_integration_test_docker_environment.testing.exaslct_test_environment import ExaslctTestEnvironment
+from exasol_integration_test_docker_environment.testing.utils import check_db_version_from_env, \
+    db_version_supports_custom_certificates
+
+
+class CertificateTest(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        print(f"SetUp {cls.__name__}")
+        # We can't use start-test-env. because it only mounts ./ and
+        # doesn't work with --build_ouput-directory
+        cls.test_environment = \
+            ExaslctTestEnvironment(
+                cls,
+                utils.INTEGRATION_TEST_DOCKER_ENVIRONMENT_DEFAULT_BIN,
+                clean_images_at_close=False)
+
+        cls.spawned_docker_test_environments = None
+
+        if db_version_supports_custom_certificates(check_db_version_from_env()):
+            # Important: The test environment will create a hostname consisting of a prefix + the class name +
+            #            the docker environment in the following parameter
+            #            However, host name length is limited to 63 characters. A the class name itself already creates
+            #            a unique environment, we must keep the parameter empty.
+            cls.docker_environment_name = ""
+            cls.spawned_docker_test_environments = \
+                cls.test_environment.spawn_docker_test_environments(cls.docker_environment_name,
+                                                                    additional_parameter=["--deactivate-database-setup",
+                                                                                          "--create-certificates"])
+
+    @classmethod
+    def tearDownClass(cls):
+        utils.close_environments(cls.spawned_docker_test_environments, cls.test_environment)
+
+    @unittest.skipIf(not db_version_supports_custom_certificates(check_db_version_from_env()), "Database not supported")
+    def test_certificate(self):
+        on_host_docker_environment = self.spawned_docker_test_environments.on_host_docker_environment
+        with ContextDockerClient() as docker_client:
+            test_container = docker_client.containers.get(f"test_container_{on_host_docker_environment.name}")
+
+            host_name = f"{on_host_docker_environment.environment_info.database_info.container_info.container_name}." \
+                        f"{on_host_docker_environment.environment_info.network_info.network_name}"
+            db_port = f"{on_host_docker_environment.environment_info.database_info.db_port}"
+            openssl_check_cmd = f"openssl s_client -connect {host_name}:{db_port}"
+            print(f"OpenSSL cmd:{openssl_check_cmd}")
+            exit_code, output = test_container.exec_run(openssl_check_cmd)
+            print(f"fOpenSSL out:{output}")
+            self.assertEqual(exit_code, 0)
+            log = output.decode("utf-8")
+            expected_subject = f"subject=C = XX, ST = N/A, L = N/A, O = Self-signed certificate, " \
+                               f"CN = {host_name}"
+            self.assertIn(expected_subject, log, "Certificate check")
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/exasol_integration_test_docker_environment/test/test_test_environment_db_disk_size.py b/exasol_integration_test_docker_environment/test/test_test_environment_db_disk_size.py
index 2362b6b52..3643aa8e4 100644
--- a/exasol_integration_test_docker_environment/test/test_test_environment_db_disk_size.py
+++ b/exasol_integration_test_docker_environment/test/test_test_environment_db_disk_size.py
@@ -38,20 +38,29 @@ def assert_disk_size(self, size: str):
 
     def test_default_db_disk_size(self):
         self.docker_environment_name = "test_default_db_disk_size"
-        with self.test_environment.spawn_docker_test_environments(self.docker_environment_name):
+        with self.test_environment.spawn_docker_test_environments(name=self.docker_environment_name,
+                                                                  additional_parameter=[
+                                                                      "--deactivate-database-setup"
+                                                                  ]):
             self.assert_disk_size("2 GiB")
 
     def test_smallest_valid_db_disk_size(self):
         self.docker_environment_name = "test_smallest_valid_db_disk_size"
-        with self.test_environment.spawn_docker_test_environments(self.docker_environment_name,
-                                                                  ["--db-disk-size", "'100 MiB'"]):
+        with self.test_environment.spawn_docker_test_environments(name=self.docker_environment_name,
+                                                                  additional_parameter=[
+                                                                    "--db-disk-size", "'100 MiB'",
+                                                                    "--deactivate-database-setup"
+                                                                  ]):
             self.assert_disk_size("100 MiB")
 
     def test_invalid_db_mem_size(self):
         self.docker_environment_name = "test_invalid_db_disk_size"
         with self.assertRaises(Exception) as context:
-            with self.test_environment.spawn_docker_test_environments(self.docker_environment_name,
-                                                                      ["--db-disk-size", "'90 MiB'"]):
+            with self.test_environment.spawn_docker_test_environments(name=self.docker_environment_name,
+                                                                      additional_parameter=[
+                                                                        "--db-disk-size", "'90 MiB'",
+                                                                        "--deactivate-database-setup"
+                                                                      ]):
                 pass
 
 
diff --git a/exasol_integration_test_docker_environment/test/test_test_environment_db_mem_size.py b/exasol_integration_test_docker_environment/test/test_test_environment_db_mem_size.py
index dddb96dad..47ae872f0 100644
--- a/exasol_integration_test_docker_environment/test/test_test_environment_db_mem_size.py
+++ b/exasol_integration_test_docker_environment/test/test_test_environment_db_mem_size.py
@@ -38,21 +38,30 @@ def assert_mem_size(self, size: str):
 
     def test_default_db_mem_size(self):
         self.docker_environment_name = "test_default_db_mem_size"
-        with self.test_environment.spawn_docker_test_environments(self.docker_environment_name):
+        with self.test_environment.spawn_docker_test_environments(name=self.docker_environment_name,
+                                                                  additional_parameter=[
+                                                                      "--deactivate-database-setup",
+                                                                  ]):
             self.assert_mem_size("2 GiB")
 
     def test_smallest_valid_db_mem_size(self):
         self.docker_environment_name = "test_smallest_valid_db_mem_size"
 
-        with self.test_environment.spawn_docker_test_environments(self.docker_environment_name,
-                                                                  ["--db-mem-size", "'1 GiB'"]):
+        with self.test_environment.spawn_docker_test_environments(name=self.docker_environment_name,
+                                                                  additional_parameter=[
+                                                                      "--db-mem-size", "'1 GiB'",
+                                                                      "--deactivate-database-setup",
+                                                                  ]):
             self.assert_mem_size("1 GiB")
 
     def test_invalid_db_mem_size(self):
         self.docker_environment_name = "test_invalid_db_mem_size"
         with self.assertRaises(Exception) as context:
-            with self.test_environment.spawn_docker_test_environments(self.docker_environment_name,
-                                                                      ["--db-mem-size", "'999 MiB'"]):
+            with self.test_environment.spawn_docker_test_environments(name=self.docker_environment_name,
+                                                                      additional_parameter=[
+                                                                        "--db-mem-size", "'999 MiB'",
+                                                                        "--deactivate-database-setup",
+                                                                      ]):
                 pass
 
 
diff --git a/exasol_integration_test_docker_environment/test/test_test_environment_docker_runtime.py b/exasol_integration_test_docker_environment/test/test_test_environment_docker_runtime.py
index 08cab520f..378da389f 100644
--- a/exasol_integration_test_docker_environment/test/test_test_environment_docker_runtime.py
+++ b/exasol_integration_test_docker_environment/test/test_test_environment_docker_runtime.py
@@ -46,7 +46,10 @@ def setUpClass(cls):
                 clean_images_at_close=False)
         cls.docker_environment_name = "test_no_runtime_given"
         cls.spawned_docker_test_environments = \
-            cls.test_environment.spawn_docker_test_environments(cls.docker_environment_name)
+            cls.test_environment.spawn_docker_test_environments(name=cls.docker_environment_name,
+                                                                additional_parameter=[
+                                                                    "--deactivate-database-setup"
+                                                                ])
         cls.default_docker_runtime = get_default_docker_runtime()
 
     @classmethod
@@ -90,7 +93,10 @@ def setUpClass(cls):
         cls.docker_environment_name = "test_default_runtime_given"
         cls.spawned_docker_test_environments = cls.test_environment.spawn_docker_test_environments(
                 cls.docker_environment_name,
-                additional_parameter=["--docker-runtime", cls.default_docker_runtime])
+                additional_parameter=[
+                    "--docker-runtime", cls.default_docker_runtime,
+                    "--deactivate-database-setup",
+                ])
 
     @classmethod
     def tearDownClass(cls):
@@ -135,7 +141,10 @@ def setUpClass(cls):
         try:
             cls.spawned_docker_test_environments = cls.test_environment.spawn_docker_test_environments(
                     cls.docker_environment_name,
-                    additional_parameter=["--docker-runtime", "AAAABBBBCCCC_INVALID_RUNTIME_111122223333"])
+                    additional_parameter=[
+                        "--docker-runtime", "AAAABBBBCCCC_INVALID_RUNTIME_111122223333",
+                        "--deactivate-database-setup",
+                    ])
         except Exception as e:
             pass
 
diff --git a/exasol_integration_test_docker_environment/test/test_test_environment_nameservers.py b/exasol_integration_test_docker_environment/test/test_test_environment_nameservers.py
index b99d82ad7..6061f02fc 100644
--- a/exasol_integration_test_docker_environment/test/test_test_environment_nameservers.py
+++ b/exasol_integration_test_docker_environment/test/test_test_environment_nameservers.py
@@ -39,7 +39,11 @@ def assert_nameserver(self, nameservers: str):
 
     def test_no_nameserver(self):
         self.docker_environment_name = "test_no_nameserver"
-        with self.test_environment.spawn_docker_test_environments(self.docker_environment_name):
+        with self.test_environment.spawn_docker_test_environments(self.docker_environment_name,
+                                                                  [
+                                                                      "--deactivate-database-setup",
+                                                                  ]
+                                                                  ):
             self.assert_nameserver("")
 
     def test_single_nameserver(self):
@@ -47,6 +51,7 @@ def test_single_nameserver(self):
         with self.test_environment.spawn_docker_test_environments(self.docker_environment_name,
                                                                   [
                                                                     "--nameserver", "'8.8.8.8'",
+                                                                    "--deactivate-database-setup",
                                                                   ]):
             self.assert_nameserver("8.8.8.8")
 
@@ -56,6 +61,7 @@ def test_multiple_nameserver(self):
                                                                   [
                                                                     "--nameserver", "'8.8.8.8'",
                                                                     "--nameserver", "'8.8.8.9'",
+                                                                    "--deactivate-database-setup",
                                                                   ]):
             self.assert_nameserver("8.8.8.8,8.8.8.9")
 
diff --git a/exasol_integration_test_docker_environment/test_container_config/create_certificates.sh b/exasol_integration_test_docker_environment/test_container_config/create_certificates.sh
new file mode 100644
index 000000000..c997d8165
--- /dev/null
+++ b/exasol_integration_test_docker_environment/test_container_config/create_certificates.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+set -euo pipefail
+
+NAME={{HOST_NAME}}
+
+echo SubjectName: $NAME
+
+certs_dir={{cert_dir}}
+
+echo Certificate Dir: $certs_dir
+
+if [ ! -d "$certs_dir" ]
+then
+  mkdir -p "$certs_dir"
+fi
+pushd "$certs_dir"
+
+# Creae rootCA key and certificate
+openssl genrsa -out rootCA.key 2048
+openssl req -x509 -nodes -new -key rootCA.key -out rootCA.crt -subj "/C=US/ST=CA/O=Self-signed certificate/CN=$NAME"
+
+
+# Create server key, certificate request and certificate
+echo "[req]
+default_bits  = 2048
+distinguished_name = req_distinguished_name
+req_extensions = req_ext
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+countryName = XX
+stateOrProvinceName = N/A
+localityName = N/A
+organizationName = Self-signed certificate
+commonName = $NAME
+[req_ext]
+subjectAltName = @alt_names
+[v3_req]
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = $NAME
+DNS.2 = exasol-test-database
+" > san.cnf
+openssl genrsa -out cert.key 2048
+openssl req -new -sha256 -key cert.key -out cert.csr -config san.cnf
+
+echo "
+subjectAltName = DNS.1:$NAME, DNS.2:exasol-test-database
+" > alt_names.ext
+
+openssl x509 -req -in cert.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out cert.crt -sha256 -extfile alt_names.ext
+
+ls $certs_dir
\ No newline at end of file
diff --git a/exasol_integration_test_docker_environment/test_container_config/install_root_certificate.sh b/exasol_integration_test_docker_environment/test_container_config/install_root_certificate.sh
new file mode 100755
index 000000000..7d3d19a47
--- /dev/null
+++ b/exasol_integration_test_docker_environment/test_container_config/install_root_certificate.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -euo pipefail
+
+#Install Linux certificates (useful for pyexasol)
+cp /certificates/rootCA.crt /usr/local/share/ca-certificates/
+update-ca-certificates
+
+#Update java ca certs
+keytool -keystore /etc/ssl/certs/java/cacerts -import -file /certificates/rootCA.crt -storepass changeit -noprompt
\ No newline at end of file
diff --git a/exasol_integration_test_docker_environment/testing/exaslct_test_environment.py b/exasol_integration_test_docker_environment/testing/exaslct_test_environment.py
index 161dca28c..18cf4b2ef 100644
--- a/exasol_integration_test_docker_environment/testing/exaslct_test_environment.py
+++ b/exasol_integration_test_docker_environment/testing/exaslct_test_environment.py
@@ -13,7 +13,7 @@
 from exasol_integration_test_docker_environment.testing.exaslct_docker_test_environment import \
     ExaslctDockerTestEnvironment
 from exasol_integration_test_docker_environment.testing.spawned_test_environments import SpawnedTestEnvironments
-from exasol_integration_test_docker_environment.testing.utils import find_free_port
+from exasol_integration_test_docker_environment.testing.utils import find_free_port, check_db_version_from_env
 
 
 class ExaslctTestEnvironment:
@@ -120,8 +120,9 @@ def spawn_docker_test_environments(self, name: str, additional_parameter: List[s
             database_port=find_free_port(),
             bucketfs_port=find_free_port())
         docker_db_version_parameter = ""
-        if "EXASOL_VERSION" in os.environ and os.environ["EXASOL_VERSION"] != "default":
-            docker_db_version_parameter = f'--docker-db-image-version "{os.environ["EXASOL_VERSION"]}"'
+        db_version_from_env = check_db_version_from_env()
+        if db_version_from_env is not None:
+            docker_db_version_parameter = f'--docker-db-image-version "{db_version_from_env}"'
         if additional_parameter is None:
             additional_parameter = []
         arguments = " ".join([f"--environment-name {on_host_parameter.name}",
diff --git a/exasol_integration_test_docker_environment/testing/utils.py b/exasol_integration_test_docker_environment/testing/utils.py
index 96aa1b841..f517f6daa 100644
--- a/exasol_integration_test_docker_environment/testing/utils.py
+++ b/exasol_integration_test_docker_environment/testing/utils.py
@@ -1,6 +1,8 @@
 import json
+import os
 import socket
 from contextlib import closing
+from typing import Optional
 
 import requests
 
@@ -58,3 +60,17 @@ def close_environments(*args):
                 env.close()
         except Exception as e:
             print(e)
+
+
+def check_db_version_from_env() -> Optional[str]:
+    retval = None
+    if "EXASOL_VERSION" in os.environ and os.environ["EXASOL_VERSION"] != "default":
+        retval = os.environ["EXASOL_VERSION"]
+    return retval
+
+
+def db_version_supports_custom_certificates(db_version: Optional[str]) -> bool:
+    # 1. If db_version is None => Latest DB version is used (which already supported custom certificates in EXAConf
+    # 2. If db_version is "default" => Return True, as "default" is lexically greater than "7.0.5"
+    # 3. Return result of db version comparison
+    return True if db_version is None or db_version > "7.0.5" else False