<commit_before>[id="cert-types-proxy-certificates"]
= Proxy certificates
include::modules/common-attributes.adoc[]
:context: cert-types-proxy-certificates

toc::[]

== Purpose

Proxy certificates allow users to specify one or more custom certificate authority (CA) certificates used by platform components when making egress connections.

The `trustedCA` field of the Proxy object is a reference to a config map that contains a user-provided trusted certificate authority (CA) bundle. This bundle is merged with the {op-system-first} trust bundle and injected into the trust store of platform components that make egress HTTPS calls. For example, `image-registry-operator` calls an external image registry to download images. If `trustedCA` is not specified, only the {op-system} trust bundle is used for proxied HTTPS connections. Provide custom CA certificates to the {op-system} trust bundle if you want to use your own certificate infrastructure.

The `trustedCA` field should only be consumed by a proxy validator. The validator is responsible for reading the certificate bundle from required key `ca-bundle.crt` and copying it to a config map named `trusted-ca-bundle` in the `openshift-config-managed` namespace. The namespace for the config map referenced by `trustedCA` is `openshift-config`:

[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
  name: user-ca-bundle
  namespace: openshift-config
data:
  ca-bundle.crt: |
  -----BEGIN CERTIFICATE-----
  Custom CA certificate bundle.
  -----END CERTIFICATE-----
----

[discrete]
=== Additional resources

* xref:../../networking/enable-cluster-wide-proxy.adoc#enable-cluster-wide-proxy[Configuring the cluster-wide proxy]

== Managing proxy certificates during installation

The `additionalTrustBundle` value of the installer configuration is used to specify any proxy-trusted CA certificates during installation. For example:

[source,terminal]
----
$ cat install-config.yaml
----
<commit_msg>Fixed indentation in sample proxy certificate.<commit_after>[id="cert-types-proxy-certificates"]
= Proxy certificates
include::modules/common-attributes.adoc[]
:context: cert-types-proxy-certificates

toc::[]

== Purpose

Proxy certificates allow users to specify one or more custom certificate authority (CA) certificates used by platform components when making egress connections.

The `trustedCA` field of the Proxy object is a reference to a config map that contains a user-provided trusted certificate authority (CA) bundle. This bundle is merged with the {op-system-first} trust bundle and injected into the trust store of platform components that make egress HTTPS calls. For example, `image-registry-operator` calls an external image registry to download images. If `trustedCA` is not specified, only the {op-system} trust bundle is used for proxied HTTPS connections. Provide custom CA certificates to the {op-system} trust bundle if you want to use your own certificate infrastructure.

The `trustedCA` field should only be consumed by a proxy validator. The validator is responsible for reading the certificate bundle from required key `ca-bundle.crt` and copying it to a config map named `trusted-ca-bundle` in the `openshift-config-managed` namespace. The namespace for the config map referenced by `trustedCA` is `openshift-config`:

[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
  name: user-ca-bundle
  namespace: openshift-config
data:
  ca-bundle.crt: |
    -----BEGIN CERTIFICATE-----
    Custom CA certificate bundle.
    -----END CERTIFICATE-----
----

[discrete]
=== Additional resources

* xref:../../networking/enable-cluster-wide-proxy.adoc#enable-cluster-wide-proxy[Configuring the cluster-wide proxy]

== Managing proxy certificates during installation

The `additionalTrustBundle` value of the installer configuration is used to specify any proxy-trusted CA certificates during installation. For example:

[source,terminal]
----
$ cat install-config.yaml
----

{'fraction_non_alphanumeric': 0.08802017654476671, 'fraction_numerical': 0.0005044136191677175, 'mean_word_length': 4.578059071729958, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6540325', 'n_tokens_mistral': 1055, 'n_tokens_neox': 994, 'n_words': 451}