Repository navigation
Unable to configure SSL CA certificate for Passbolt CE Docker image with PostgreSQL #246
Description
Hello everyone,
Description:
I'm trying to run the Passbolt CE Docker image with an Azure Flexible PostgreSQL server that enforces SSL connections. I have mounted the CA certificate and set the environment variable DATASOURCES_DEFAULT_SSL_CA, but the application fails to pick up the certificate, resulting in a permission error.
Docker Compose snippet:
services:
passbolt:
image: passbolt/passbolt:latest-ce
container_name: passbolt
restart: unless-stopped
ports:
- "8004:80"
volumes:
- passbolt/volumes/gpg:/etc/passbolt/gpg
- passbolt/volumes/jwt:/etc/passbolt/jwt
- passbolt/volumes/postgresql/postgresql.crt:/etc/passbolt/postgresql/ca.crt
environment:
APP_FULL_BASE_URL: "https://pass.example.com"
DATASOURCES_DEFAULT_DRIVER: Cake\Database\Driver\Postgres
DATASOURCES_DEFAULT_HOST: "pg.example.postgres.database.azure.com"
DATASOURCES_DEFAULT_PORT: "5432"
DATASOURCES_DEFAULT_USERNAME: "app-passbolt"
DATASOURCES_DEFAULT_PASSWORD: "XXX"
DATASOURCES_DEFAULT_DATABASE: "app-passbolt"
DATASOURCES_DEFAULT_SCHEMA: "passbolt"
DATASOURCES_DEFAULT_SSL_CA: "/etc/passbolt/postgresql/ca.crt"
DATASOURCES_DEFAULT_SSLMODE: "require"
DATASOURCES_DEFAULT_LOG: "true"
DATASOURCES_DEFAULT_ENCODING: "utf8"
Error observed:
2025-10-16 08:16:01 error: [Cake\Database\Exception\MissingConnectionException]
Connection to Postgres could not be established:
SQLSTATE[08006] [7] connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed:
could not open certificate file "/root/.postgresql/postgresql.crt": Permission denied
connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed:
FATAL: no pg_hba.conf entry for host "10.2.0.5", user "app-passbolt", database "app-passbolt", no encryption
in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Database/Driver.php on line 144
Caused by: [PDOException] SQLSTATE[08006] [7] connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed:
could not open certificate file "/root/.postgresql/postgresql.crt": Permission denied
connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed:
FATAL: no pg_hba.conf entry for host "10.2.0.5", user "app-passbolt", database "app-passbolt", no encryption
in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Database/Driver.php on line 132
2025-10-16 08:16:01 error: Could not connect to Database.
Observations:
The environment variable is correctly visible inside the container:
$ sudo docker exec -it passbolt env | grep _SSL_CA
DATASOURCES_DEFAULT_SSL_CA=/etc/passbolt/postgresql/ca.crt
Mounting the CA certificate as root with user: root.
Direct psql tests using the same certificate work:
psql "host=pg.example.postgres.database.azure.com port=5432 dbname=app-passbolt user=app-passbolt sslmode=verify-full sslrootcert=passbolt/volumes/postgresql/postgresql.crt"
psql "host=pg.example.postgres.database.azure.com port=5432 dbname=app-passbolt user=app-passbolt sslmode=require"
Both connections succeed.
Problem:
The Passbolt CE Docker container ignores the DATASOURCES_DEFAULT_SSL_CA path and tries to use /root/.postgresql/postgresql.crt, resulting in a permission error. It seems that Passbolt CE or CakePHP does not pick up the custom CA path.
Request:
- Guidance on how to correctly configure the SSL CA for Passbolt CE Docker container connecting to Azure PostgreSQL.
- Is it possible to use DATASOURCES_DEFAULT_SSLMODE=require, or is verify-full mandatory?
- Any recommended workaround to make the container recognize the mounted certificate without permission issues.
Thank you very much for your help! I hope I haven’t overlooked an obvious solution.
Activity
asenchuk commentedon Feb 24, 2026
I confirm the issue. Reproduces on the latest 5.9.0-1-ce release.
@florent-np did you solve it for your setup?
What's interesting - migrations work well. New db structure creates well on start up and then I see the same error messages as above during runtime.
florent-np commentedon Mar 26, 2026
No I gave up
hardcpp commentedon Apr 4, 2026
Same issue
hardcpp commentedon Apr 4, 2026
If you want to ignore SSL validity, this work:
DATASOURCES_DEFAULT_SSL_MODE=verify
A work around if SSL is enforced, map the /root folder of the container in a volume and create the right folders / files with your certs as chown root:www-data & chmod 640