forked from linux/documentation
27 lines
700 B
Markdown
27 lines
700 B
Markdown
# Additional CA (e.g. for TLS/SSL Interception/Inspection)
|
|
|
|
It is possible to accept other trusted root CAs.
|
|
|
|
You can add them in Hiera by first defining them with a specific `base::trusted_ca::$CA_NAME` key:
|
|
|
|
```
|
|
base::trusted_ca::my_own_ca: |
|
|
-----BEGIN CERTIFICATE-----
|
|
...
|
|
-----END CERTIFICATE-----
|
|
```
|
|
|
|
and then select them by name where required in the `base::trusted_cas` list:
|
|
|
|
```
|
|
base::trusted_cas:
|
|
- my_own_ca
|
|
```
|
|
|
|
There is already a predefined CA `psi_ssl_interception` which is used by the PSI firewall for SSL interception. So if your systems is treated by the firewall with SSL interception then you simply can do
|
|
|
|
```
|
|
base::trusted_cas:
|
|
- psi_ssl_interception
|
|
```
|