Using the cf CLI with a Self-Signed Certificate
Page last updated:
This topic describes how developers can use the Cloud Foundry Command Line Interface (cf CLI) to communicate securely with a Cloud Foundry deployment with a self-signed certificate.
Overview
You can use the cf CLI to communicate securely with a Cloud Foundry deployment without
specifying --skip-ssl-validation
under these circumstances:
The deployment uses a self-signed certificate.
The deployment uses a certificate that is signed by a self-signed certificate authority (CA), or a certificate signed by a certificate that is signed by a self-signed CA.
Before following the procedure below, the developer must obtain either the self-signed certificate or the intermediate and CA certificates used to sign the deployment’s certificate. The developer can obtain these certificates from the Cloud Foundry operator or from the deployment manifest. For more information about how to retrieve certificates from the deployment manifest, see Securing Traffic into Cloud Foundry.
Install the Certificate on Local Machines
The certificates you must insert into your local truststore vary depending on the configuration of your deployment.
If the deployment uses a self-signed certificate, the you must insert the self-signed certificate into your local truststore.
If the deployment uses a certificate that is signed by a self-signed CA, or a certificate signed by a certificate that is signed by a self-signed CA, you must insert the self-signed certificate and any intermediate certificates into your local truststore.
Install the Certificate on Mac OS X
To place the certificate file server.crt
into your local truststore for Mac OS X:
Run:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain server.crt
Install the Certificate on Linux
To place the certificate file server.crt
into your truststore for Linux:
Run one of these commands, depending on your Linux distrubution:
For Debian, Ubuntu, or Gentoo, run:
cat server.crt >> /etc/ssl/certs/ca-certificates.crt
For Fedora or RHEL, run:
cat server.crt >> /etc/pki/tls/certs/ca-bundle.crt
The examples above set the certificate permanently on your machine across all users and requiresudo
permissions. To set the certificate only in your current terminal or script, run one of these commands:export SSL_CERT_FILE=PATH-TO-SERVER.crt
WherePATH-TO-SERVER.crt
is the filepath of theserver.crt
certificate file.export SSL_CERT_DIR=PATH-TO-SERVER-DIRECTORY
WherePATH-TO-SERVER-DIRECTORY
is the directory of theserver.crt
certificate file.
Install the Certificate on Windows
To place the certificate file server.crt
into your local truststore for Windows:
Right-click on the certificate file.
Click Install Certificate.
Choose to install the certificate as the Current User or Local Machine.
From the certification store list, select Trusted Root Certification Authorities.