Custom Root CA in spring-boot:build-image
Tags: springbootmavenplugin, springboot, buildpack, docker
Published: 2023-04-12 14:46:48

---
title: Custom Root CA in spring-boot:build-image
published: true
description: 
tags: springbootmavenplugin, springboot, buildpack, docker
# cover_image: https://direct_url_to_image.jpg
# Use a ratio of 100:42 for best results.
# published_at: 2023-04-12 13:44 +0000
---

The Spring Framework has a very useful feature which is the generation of a docker image through the spring-boot-maven-plugin. Simply running `mvn spring-boot:build-image` will create a docker compatible OCI image.

But if you are behind a corporate proxy, this error is likely to happen:

```
[INFO]     [creator]       BellSoft Liberica JRE 17.0.6: Contributing to layer

[INFO]     [creator]         Downloading from https://github.com/bell-sw/Liberica/releases/download/17.0.6+10/bellsoft-jre17.0.6+10-linux-amd64.tar.gz

[INFO]     [creator]     unable to invoke layer creator

[INFO]     [creator]     unable to get dependency jre

[INFO]     [creator]     unable to download https://github.com/bell-sw/Liberica/releases/download/17.0.6+10/bellsoft-jre17.0.6+10-linux-amd64.tar.gz

[INFO]     [creator]     unable to request https://github.com/bell-sw/Liberica/releases/download/17.0.6+10/bellsoft-jre17.0.6+10-linux-amd64.tar.gz

[INFO]     [creator]     Get https://github.com/bell-sw/Liberica/releases/download/17.0.6+10/bellsoft-jre17.0.6+10-linux-amd64.tar.gz: x509: certificate signed by unknown authority

[INFO]     [creator]     ERROR: failed to build: exit status 1
```

This happens because the corporation's certificate used in the proxy server is not known by the build process. When the buildpack tries download needed artifacts used inside the build process, it stops because the certificate is not trusted.

spring-boot-maven-plugin uses [Cloud Native Buildpacks](https://buildpacks.io/) under the hood, and it allows some [customization](https://docs.spring.io/spring-boot/docs/current/maven-plugin/reference/htmlsingle/#build-image) of the build process.

We need to put our corporate root CA certificates into the buildpack. For this we will create the files `mycert.cer` and `type` in the structure below:

```
.
├── pom.xml
└── src
    └── main
        └── bindings
            └── ca-certificates
                ├── mycert.cer
                └── type
```

`src/main/bindings/ca-certificates/mycert.cer`:
```
-----BEGIN CERTIFICATE-----
Base64–encoded certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Base64–encoded certificate
-----END CERTIFICATE-----
```

`src/main/bindings/ca-certificates/type`:
```
ca-certificates
```

The following Maven configuration will add the certificate to the buildpack.

`pom.xml`:
```xml
<plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
    <configuration>
        <image>
            <env>
                <SERVICE_BINDING_ROOT>/bindings</SERVICE_BINDING_ROOT>
            </env>
            <bindings>
                <binding>${project.basedir}/src/main/bindings/ca-certificates:/bindings/ca-certificates</binding>
            </bindings>
        </image>
    </configuration>
</plugin>
```

Now, `mvn spring-boot:build-image` should work!