Unable to configure SSL CA certificate for Passbolt CE Docker image with PostgreSQL

[florent-np]

Hello everyone,

Description:

I'm trying to run the Passbolt CE Docker image with an Azure Flexible PostgreSQL server that enforces SSL connections. I have mounted the CA certificate and set the environment variable DATASOURCES_DEFAULT_SSL_CA, but the application fails to pick up the certificate, resulting in a permission error.

Docker Compose snippet:

services:
  passbolt:
    image: passbolt/passbolt:latest-ce
    container_name: passbolt
    restart: unless-stopped
    ports:
      - "8004:80"
    volumes:
      - passbolt/volumes/gpg:/etc/passbolt/gpg
      - passbolt/volumes/jwt:/etc/passbolt/jwt
      - passbolt/volumes/postgresql/postgresql.crt:/etc/passbolt/postgresql/ca.crt
    environment:
      APP_FULL_BASE_URL: "https://pass.example.com"
      DATASOURCES_DEFAULT_DRIVER: Cake\Database\Driver\Postgres
      DATASOURCES_DEFAULT_HOST: "pg.example.postgres.database.azure.com"
      DATASOURCES_DEFAULT_PORT: "5432"
      DATASOURCES_DEFAULT_USERNAME: "app-passbolt"
      DATASOURCES_DEFAULT_PASSWORD: "XXX"
      DATASOURCES_DEFAULT_DATABASE: "app-passbolt"
      DATASOURCES_DEFAULT_SCHEMA: "passbolt"
      DATASOURCES_DEFAULT_SSL_CA: "/etc/passbolt/postgresql/ca.crt"
      DATASOURCES_DEFAULT_SSLMODE: "require"
      DATASOURCES_DEFAULT_LOG: "true"
      DATASOURCES_DEFAULT_ENCODING: "utf8"

Error observed:

2025-10-16 08:16:01 error: [Cake\Database\Exception\MissingConnectionException] 
Connection to Postgres could not be established: 
SQLSTATE[08006] [7] connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed: 
could not open certificate file "/root/.postgresql/postgresql.crt": Permission denied
connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed: 
FATAL:  no pg_hba.conf entry for host "10.2.0.5", user "app-passbolt", database "app-passbolt", no encryption 
in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Database/Driver.php on line 144
Caused by: [PDOException] SQLSTATE[08006] [7] connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed: 
could not open certificate file "/root/.postgresql/postgresql.crt": Permission denied
connection to server at "pg.example.postgres.database.azure.com" (), port 5432 failed: 
FATAL:  no pg_hba.conf entry for host "10.2.0.5", user "app-passbolt", database "app-passbolt", no encryption 
in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Database/Driver.php on line 132
2025-10-16 08:16:01 error: Could not connect to Database.

Observations:

The environment variable is correctly visible inside the container:

$ sudo docker exec -it passbolt env | grep _SSL_CA
DATASOURCES_DEFAULT_SSL_CA=/etc/passbolt/postgresql/ca.crt

Mounting the CA certificate as root with user: root.

Direct psql tests using the same certificate work:

psql "host=pg.example.postgres.database.azure.com port=5432 dbname=app-passbolt user=app-passbolt sslmode=verify-full sslrootcert=passbolt/volumes/postgresql/postgresql.crt"
psql "host=pg.example.postgres.database.azure.com port=5432 dbname=app-passbolt user=app-passbolt sslmode=require"

Both connections succeed.

Problem:

The Passbolt CE Docker container ignores the DATASOURCES_DEFAULT_SSL_CA path and tries to use /root/.postgresql/postgresql.crt, resulting in a permission error. It seems that Passbolt CE or CakePHP does not pick up the custom CA path.

Request:

• Guidance on how to correctly configure the SSL CA for Passbolt CE Docker container connecting to Azure PostgreSQL.
• Is it possible to use DATASOURCES_DEFAULT_SSLMODE=require, or is verify-full mandatory?
• Any recommended workaround to make the container recognize the mounted certificate without permission issues.

Thank you very much for your help! I hope I haven’t overlooked an obvious solution.

[asenchuk]

I confirm the issue. Reproduces on the latest 5.9.0-1-ce release.
@florent-np did you solve it for your setup?

What's interesting - migrations work well. New db structure creates well on start up and then I see the same error messages as above during runtime.

[florent-np]

No I gave up

[hardcpp]

Same issue

[hardcpp]

If you want to ignore SSL validity, this work:
DATASOURCES_DEFAULT_SSL_MODE=verify

A work around if SSL is enforced, map the /root folder of the container in a volume and create the right folders / files with your certs as chown root:www-data & chmod 640