//Module included in the following assemblies:
//
//* microshift_install/microshift-embed-in-rpm-ostree.adoc


:_mod-docs-content-type: PROCEDURE
[id="microshift-ca-adding-bundle-ostree_{context}"]
= Adding a certificate authority bundle to an rpm-ostree image
You can include additional trusted certificate authorities (CAs) to the {op-system-ostree-first} `rpm-ostree` image by adding them to the blueprint that you use to create the image. Using the following procedure sets up additional CAs to be trusted by the operating system when pulling images from an image registry.

[NOTE]
====
This procedure requires you to configure the CA bundle customizations in the blueprint, and then add steps to your kickstart file to enable the bundle. In the following steps, `data` is the key, and `<value>` represents the PEM-encoded certificate.
====

.Prerequisites

* You have root user access to your build host.
* Your build host meets the Image Builder system requirements.
* You have installed and set up Image Builder and the `composer-cli` tool.

.Procedure

. Add the following custom values to your blueprint to add a directory.

.. Add instructions to your blueprint on the host where the image is built to create the directory, for example, `/etc/pki/ca-trust/source/anchors/` for your certificate bundles.
+
[source,terminal]
----
[[customizations.directories]]
path = "/etc/pki/ca-trust/source/anchors"
----

.. After the image has booted, create the certificate bundles, for example, `/etc/pki/ca-trust/source/anchors/cert1.pem`:
+
[source,terminal]
----
[[customizations.files]]
path = "/etc/pki/ca-trust/source/anchors/cert1.pem"
data = "<value>"
----

. To enable the certificate bundle in the system-wide trust store configuration, use the `update-ca-trust` command on the host where the image you are using has booted, for example:
+
[source,terminal]
----
$ sudo update-ca-trust
----

[NOTE]
====
The `update-ca-trust` command might be included in the `%post` section of a kickstart file used for MicroShift host installation so that all the necessary certificate trust is enabled on the first boot. You must configure the CA bundle customizations in the blueprint before adding steps to your kickstart file to enable the bundle.

[source,terminal]
----
%post
# Update certificate trust storage in case new certificates were
# installed at /etc/pki/ca-trust/source/anchors directory
update-ca-trust
%end
----
====
