SSL Certificate Unknown Authority Issue When Trying to Use Actions To Sites That have Self Signed Certs.

[jamesgraves52]

When trying to use an agent that has an action that is trying do API calls to a site that hase Self Signed Certs I get a SSL Certificate Unknown Authority error. Requesting if on the step 3 (configuration) of the Action can their be a place to upload the public CA .crt file for the site we are trying to reach. This will make things alot easier for making connections to these types of sites.

[Bionic711]

This has significant security implications. Proper handling would require storing any uploaded certificates in a secure store like Key Vault and wiring them in at the application level. Given that complexity, support for custom CAs should, for now, be handled as part of the container build process and involve the platform/infrastructure administrators.

Enabling this per plugin is non‑trivial: you’d need to update every plugin to optionally accept a custom CA, and that only works if the underlying libraries support it. If they do not, the only remaining option is to modify the container’s global trust store, which is something no end user or application admin should be able to do. Changes to the global trust store must be performed only during image build or deployment by infrastructure administrators, as part of the container’s lifecycle and security hardening.

For example, Azure SQL and other Azure-based plugins might be able to inject the cert into the azure.core.pipeline.transport.RequestsTransport as a part of the instantiation of the plugin.

@paullizer What are your thoughts?

@jamesgraves52 Is there a particular plugin you are focusing on for this that may help us narrow a focus in a preliminary practicality investigation?