Does cert-manager currently support Digicert's fifth generation root certificates?

[atsang36]

I took a look into the cert-manager-controller image and saw that the distroless/static:nonroot image currently doesn't seem to have any fifth gen root certificates. Is there any plans to add support for them?

Thanks

[SgtCoDFish]

Thanks for raising this - I took a look under the hood and it led to #6477 and #6476 which are things we need to fix! Unrelated to your question, but your question helped us realise there could be an issue there!

To answer your question: Our current policy is to do whatever the distroless images do. All currently supported versions of cert-manager use distroless which is based on Debian 11 (bullseye).

We'll upgrade at some point in the near-ish future to Debian 12 (bookworm). If that includes digicert's 5th gen root, then we'll include it - I've not checked if that specific cert is included in debian 12.

I think generally it's unlikely we'll go out of our way to manually add a new root unless there's a really big need for it!

[jsoref]

bullseye does not have G5

% docker run -it bullseye
Unable to find image 'bullseye:latest' locally
docker: Error response from daemon: pull access denied for bullseye, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.
See 'docker run --help'.
jsoref@jsoref-mbp ~ % docker run -it debian:bullseye
WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested
root@5121e39dc805:/# apt update
Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:2 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]
Get:4 http://deb.debian.org/debian bullseye/main amd64 Packages [8062 kB]
Get:5 http://deb.debian.org/debian-security bullseye-security/main amd64 Packages [258 kB]
Get:6 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [17.7 kB]
Fetched 8546 kB in 3s (2904 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
15 packages can be upgraded. Run 'apt list --upgradable' to see them.
root@5121e39dc805:/# apt install ca-certificates
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  ca-certificates
0 upgraded, 1 newly installed, 0 to remove and 15 not upgraded.
Need to get 158 kB of archives.
After this operation, 391 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian bullseye/main amd64 ca-certificates all 20210119 [158 kB]
Fetched 158 kB in 0s (2033 kB/s)
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package ca-certificates.
(Reading database ... 6816 files and directories currently installed.)
Preparing to unpack .../ca-certificates_20210119_all.deb ...
Unpacking ca-certificates (20210119) ...
Setting up ca-certificates (20210119) ...
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 78.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.32.1 /usr/local/share/perl/5.32.1 /usr/lib/x86_64-linux-gnu/perl5/5.32 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl-base /usr/lib/x86_64-linux-gnu/perl/5.32 /usr/share/perl/5.32 /usr/local/lib/site_perl) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 7.)
debconf: falling back to frontend: Teletype
Updating certificates in /etc/ssl/certs...
129 added, 0 removed; done.
Processing triggers for ca-certificates (20210119) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
root@5121e39dc805:/# cd /etc/ssl/certs/
root@5121e39dc805:/etc/ssl/certs# ls Digi*
DigiCert_Assured_ID_Root_CA.pem  DigiCert_Global_Root_G2.pem
DigiCert_Assured_ID_Root_G2.pem  DigiCert_Global_Root_G3.pem
DigiCert_Assured_ID_Root_G3.pem  DigiCert_High_Assurance_EV_Root_CA.pem
DigiCert_Global_Root_CA.pem	 DigiCert_Trusted_Root_G4.pem
root@5121e39dc805:/etc/ssl/certs#

bookworm has G5

% docker run --rm -it debian:bookworm
Unable to find image 'debian:bookworm' locally
bookworm: Pulling from library/debian
8024d4fb53b2: Pull complete
Digest: sha256:fab22df37377621693c68650b06680c0d8f7c6bf816ec92637944778db3ca2c0
Status: Downloaded newer image for debian:bookworm
root@9668c3e8137d:/# apt update
Get:1 http://deb.debian.org/debian bookworm InRelease [151 kB]
Get:2 http://deb.debian.org/debian bookworm-updates InRelease [52.1 kB]
Get:3 http://deb.debian.org/debian-security bookworm-security InRelease [48.0 kB]
Get:4 http://deb.debian.org/debian bookworm/main arm64 Packages [8681 kB]
Get:5 http://deb.debian.org/debian bookworm-updates/main arm64 Packages [6672 B]
Get:6 http://deb.debian.org/debian-security bookworm-security/main arm64 Packages [98.2 kB]
Fetched 9037 kB in 2s (5625 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
root@9668c3e8137d:/# apt install ca-certificates
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libssl3 openssl
The following NEW packages will be installed:
  ca-certificates libssl3 openssl
0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.
Need to get 3342 kB of archives.
After this operation, 8771 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://deb.debian.org/debian-security bookworm-security/main arm64 libssl3 arm64 3.0.11-1~deb12u2 [1803 kB]
Get:2 http://deb.debian.org/debian-security bookworm-security/main arm64 openssl arm64 3.0.11-1~deb12u2 [1385 kB]
Get:3 http://deb.debian.org/debian bookworm/main arm64 ca-certificates all 20230311 [153 kB]
Fetched 3342 kB in 0s (8012 kB/s)
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package libssl3:arm64.
(Reading database ... 6092 files and directories currently installed.)
Preparing to unpack .../libssl3_3.0.11-1~deb12u2_arm64.deb ...
Unpacking libssl3:arm64 (3.0.11-1~deb12u2) ...
Selecting previously unselected package openssl.
Preparing to unpack .../openssl_3.0.11-1~deb12u2_arm64.deb ...
Unpacking openssl (3.0.11-1~deb12u2) ...
Selecting previously unselected package ca-certificates.
Preparing to unpack .../ca-certificates_20230311_all.deb ...
Unpacking ca-certificates (20230311) ...
Setting up libssl3:arm64 (3.0.11-1~deb12u2) ...
Setting up openssl (3.0.11-1~deb12u2) ...
Setting up ca-certificates (20230311) ...
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 78.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC contains: /etc/perl /usr/local/lib/aarch64-linux-gnu/perl/5.36.0 /usr/local/share/perl/5.36.0 /usr/lib/aarch64-linux-gnu/perl5/5.36 /usr/share/perl5 /usr/lib/aarch64-linux-gnu/perl-base /usr/lib/aarch64-linux-gnu/perl/5.36 /usr/share/perl/5.36 /usr/local/lib/site_perl) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 7.)
debconf: falling back to frontend: Teletype
Updating certificates in /etc/ssl/certs...
140 added, 0 removed; done.
Processing triggers for libc-bin (2.36-9+deb12u3) ...
Processing triggers for ca-certificates (20230311) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
root@9668c3e8137d:/# cd /etc/ssl/certs/
root@9668c3e8137d:/etc/ssl/certs# ls *Digi*
DigiCert_Assured_ID_Root_CA.pem  DigiCert_Global_Root_G3.pem
DigiCert_Assured_ID_Root_G2.pem  DigiCert_High_Assurance_EV_Root_CA.pem
DigiCert_Assured_ID_Root_G3.pem  DigiCert_TLS_ECC_P384_Root_G5.pem
DigiCert_Global_Root_CA.pem	 DigiCert_TLS_RSA4096_Root_G5.pem
DigiCert_Global_Root_G2.pem	 DigiCert_Trusted_Root_G4.pem
root@9668c3e8137d:/etc/ssl/certs#

[SgtCoDFish]

Thanks for digging in! In that case, I suspect cert-manager v1.14 will support G5 (although we've not merged that yet so currently we're on track to support bullseye for 1.14 until I do something about it)