Custom CA trusted by Gitpod ingress fails certificate validation inside workspace containers

Gitpod does not automatically inject custom CA certificates from the ingress into the workspace container trust stores. The trust boundary is decoupled: the ingress controller terminates TLS for external traffic, while the workspace container maintains its own independent operating system trust store.

Understanding the Trust Boundary

When a user accesses a workspace, the ingress controller handles the TLS connection using the wildcard certificate provided. However, if code running inside the workspace (such as curl, git, or a custom application) attempts to make calls to that same domain, it relies on the container's local trust store. Since the private CA is not part of the container's base image, validation fails.

How to Implement CA Propagation

To resolve validation errors, you must ensure the CA bundle is present within the workspace environment. There are two primary ways to achieve this:

• Custom Workspace Image (Recommended): Include the CA certificate in your Dockerfile. This ensures every developer using that image has the trust pre-configured.

  COPY my-custom-ca.crt /usr/local/share/ca-certificates/
  RUN update-ca-certificates

  n
• Init Containers / Sidecars: If you cannot modify the image, use an initialization script or a sidecar container to mount the certificate into /etc/ssl/certs/ and run the system-specific CA update command upon container startup.

Verification and Diagnostics

To verify where the failure is occurring, run the following command within your Gitpod terminal:

# Check if the certificate chain is recognized by curl
curl -v https://your-workspace-url.com

# Verify the CA is present in the system trust store grep "Your-CA-Name" /etc/ssl/certs/ca-certificates.crt

If curl returns an "SSL certificate certificate failed" error, the issue is strictly within the container's trust store. If the browser shows an error but curl works, the issue likely resides in the browser's local certificate store or a proxy-level interference.