Configure CA Certificate Chains

Install the CA certificates used by your organization so Polarity's services and Integration Store operations can load the required chain. Keep these files separate from the combined web certificate and the platform's server certificate.

Applies To

Standard Polarity Server v5 Docker installations under /app. In the validated v5.7.8 deployment, the platform and web entrypoints build CA bundles from /app/certs/ca. The platform also creates a cleaned bundle for Node.js.

Identify the CA Chain

Start by inspecting the issuer of the certificate installed for your Polarity Server.

openssl x509 -in /app/certs/polarity.pem -issuer -noout

Obtain the full applicable CA chain from your certificate administrator, the CA's repository, or your organization's approved browser export procedure. For deployments using a service such as Zscaler, include the CA certificates required by that environment. If an observed connection error identifies a different issuer, inspect that connection and obtain its applicable chain as well.

A browser can help locate the certificates in use. Open the certificate information for the Polarity Server and export the CA certificates in PEM form. Browser controls differ by browser version, so use its certificate viewer rather than relying on a particular lock or shield icon.

Install the CA Files

Back up the existing certificate and CA files before changing them.
Place the CA certificates in /app/certs/ca on the Polarity Server. Use PEM-encoded files ending in .crt or .pem, with names containing letters, digits, underscores, and dashes before the extension. Avoid spaces and other special characters. Use the ownership and read permissions required by your installed containers.
Keep the full combined chain at /app/caddy/config/server.crt and the platform certificate at /app/certs/polarity.pem, as described in Install or Replace a Server Certificate. Adding CA files does not replace these identity files.
Restart the containers from the Docker host using the packaged scripts.
```
cd /app && ./down.sh && ./up.sh
```

GoDaddy Certificate Example

For a deployment that requires the GoDaddy G2 bundle, create /app/certs/ca first if it does not exist, then download the bundle on the server with appropriate write access.

cd /app/certs/ca
wget https://certs.godaddy.com/repository/gd_bundle-g2.crt

Confirm that this is the bundle applicable to your deployment before installing it. Then restart the containers as shown above. Other issuers require their corresponding CA files.

Verify the Result

Repeat the visual chain checks in Troubleshoot SSL and Integration Store Connections, or use its optional strict verification commands. Check both Integration Store loading and an integration installation, since a missing chain certificate commonly prevents installation even when the store page loads.

The validated deployment's application bundles differ from the operating system trust used by an independently executed curl command. When investigating a discrepancy, check the application's configured CA bundle and the actual error.

Recover or Undo

If a change causes a regression, restore the previous CA files and any identity files changed, preserve their permissions, restart the containers, and repeat the checks. Keep unrelated existing CA certificates intact.