CA_CERT sets SSL_CERT_FILE to the single corporate CA, replacing the entire trust store

[alanbem]

Problem

When CA_CERT is configured (dclaude:1954-1957):

DOCKER_ARGS+=(
    -e "NODE_EXTRA_CA_CERTS=${CA_CERT}"
    -e "SSL_CERT_FILE=${CA_CERT}"
)

NODE_EXTRA_CA_CERTS is additive — correct. But SSL_CERT_FILE replaces the trust store for every tool that honors it (curl, Python/requests, wget, openssl, …). With only the corporate CA in that file, any TLS connection not intercepted by the corporate proxy fails verification. Typical breakage: direct-to-internet paths, split-tunnel VPN setups, internal services with public certs — with misleading "certificate verify failed" errors that look like the proxy's fault.

Fix

Append instead of replace: mount the cert and have the entrypoint (already root) run

cp "$CA_CERT" /usr/local/share/ca-certificates/dclaude-corp.crt
update-ca-certificates

Then drop SSL_CERT_FILE entirely — the system bundle covers curl/python/etc., and keep NODE_EXTRA_CA_CERTS for Node (which ignores the system store).

Side benefit: removes the current requirement that the cert live inside MOUNT_ROOT (it could be mounted individually), and stops encouraging corporate CA certs to be committed into project trees.

---

Found during a full-project code review.

[alanbem]

Confirmed in practice: I hit this with my company's MitM cert. Pointed CA_CERT at the corporate cert in the project, non-intercepted TLS connections started failing, and the eventual workaround was appending the full system CA bundle into that same file so SSL_CERT_FILE had both.

That workaround has its own downsides, which the proposed fix eliminates:

• the combined bundle (~200KB of system certs + corp CA) lives in the project tree and risks getting committed
• it goes stale as distro CA bundles are updated — the container's ca-certificates package moves on, the frozen copy doesn't
• every project needs its own copy

With the entrypoint doing update-ca-certificates, the .dclaude file goes back to pointing at just the single corporate cert and the system bundle stays managed by the OS.