How do I get my certificates to work for SSL in LocalStack

user_245897 0
Viewed 2457

Update: I realized in my original post the certificates being referred to are for the database, not the localstack ports. I have updated the description and question, as I still cannot get the certificates recognized by my browser.

I cannot seem to get my certificates to work with localstack. I tried using them per the "Using custom SSL certificates" instructions from localstack, including adding the files to the temp directory listed in my volume, but they are not taking. I also tried adding the following to the volumes part of the yml:

- ./support/docker/localstack/aws.local.domain.com.pem:/certs/localhost.pem/
- ./support/docker/localstack/aws.local.domain.com.crt:/certs/localhost.-cert.pem 
- ./support/docker/localstack/aws.local.domain.com.key:c2c/certs/localhost-key.pem

Not sure of my next steps, any help would be appreciated.

Docker version = 20.10.2
I am not sure how to get localstack version, but I did do a docker pull on it as of March 17th.

docker-compose.yml

version: '3.7'
services:
  ecms_database:
    image: 339983081851.dkr.ecr.us-east-1.amazonaws.com/ecms_mysql:1.0.3
    container_name: ecms_database
    ports:
      - '33061:3306'
  memcached:
    image: 'memcached'
    container_name: memcached
    ports:
      - '11211:11211'
  localstack:
    image: localstack/localstack
    container_name: localstack
    ports:
      - "4566:4566"
      - "4571:4571"
    environment:
      - SERVICES=s3,sqs
      - DATA_DIR=/tmp/localstack/data
    volumes:
      - "/private${TMPDIR:-/tmp/localstack}:/tmp/localstack"
localstack docker
1 Answers

Localstack by default expects to have a custom certificate file inside its docker container at /tmp/localstack/server.test.pem.

The file should contain a private key and certificate info, for example:

-----BEGIN PRIVATE KEY-----
   ......your key info.....
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
   .....your cert info......
-----END CERTIFICATE-----

According to genrate_ssl_cert method, Localstack tries to load server.test.pem file, then parse it and separate the data in two local files: server.test.key and server.test.cert. If there is no .pem file or it is invalid, then localstack will generate a new certificate for you.

So, we can bind our prepared certificate from local folder to the Localstack docker container:

version: "3.8"

services:
  localstack:
    image: localstack/localstack
    # S3 port is 4566
    ports:
      - "4566:4566"
    volumes:
      - ./your-local-path/ssl_cert_localstack:/tmp/localstack/server.test.pem:ro

Please notice that browsers will complain about self-signed certificate at least once per origin url.

user_3043710
Related