From 71366d754689936d9568d8fe0b26742b78b7d8ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ervin=20R=C3=A1cz?= Date: Tue, 21 Apr 2026 16:52:35 +0300 Subject: [PATCH] docs(nebraska): add custom CA certificates section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Document `--ca-file` flag for OIDC and update server connections - Clarify usage for non-public CA certificates (internal/Let's Encrypt staging) Signed-off-by: Ervin Rácz --- content/docs/latest/nebraska/authorization.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/docs/latest/nebraska/authorization.md b/content/docs/latest/nebraska/authorization.md index 4b0787244..30e1b0e4f 100644 --- a/content/docs/latest/nebraska/authorization.md +++ b/content/docs/latest/nebraska/authorization.md @@ -51,6 +51,10 @@ because the defaults are set at half. - In the browser, access `http://localhost:8000` +## Custom CA Certificates + +If your OIDC provider or update server uses a certificate signed by a non-public CA (e.g., internal CA or Let's Encrypt staging), pass `--ca-file=/path/to/ca-bundle.pem` to trust it. The custom CAs are added to the system trust store — existing system CAs remain trusted. This applies to both the OIDC client and the syncer. In Helm deployments, set `config.caFile` instead. + # Deploying Nebraska with OIDC authentication mode > **⚠️ OIDC Implementation Updated ⚠️** @@ -482,6 +486,9 @@ $ helm install my-nebraska nebraska/nebraska --values nebraska-values.yaml - SSO session will handle re-authentication transparently if still valid. - Go to your providers token settings (either under realm or specific client) and increase the access token lifespan from minutes to hours. +- **"x509: certificate signed by unknown authority"** + - Use `--ca-file` to trust your OIDC provider's or update server's CA certificate. + - **Auth0: "JWT malformed" or decode errors** - Ensure Implicit grant is disabled in application settings. - Verify audience parameter is set correctly.