# Use custom certificates with executors

By default, executors will search for certificates in the following files and directories:

| Directory or file                                   | Distribution              |
| --------------------------------------------------- | ------------------------- |
| `/etc/ssl/certs/ca-certificates.crt`                | Debian/Ubuntu/Gentoo etc. |
| `/etc/pki/tls/certs/ca-bundle.crt`                  | Fedora/RHEL 6             |
| `/etc/ssl/ca-bundle.pem`                            | OpenSUSE                  |
| `/etc/pki/tls/cacert.pem`                           | OpenELEC                  |
| `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem` | CentOS/RHEL 7             |
| `/etc/ssl/cert.pem`                                 | Alpine Linux              |
| `/etc/ssl/certs`                                    | SLES10/SLES11             |
| `/etc/pki/tls/certs`                                | Fedora/RHEL               |
| `/system/etc/security/cacerts`                      | Android                   |

If your environment makes use of custom certificates, you can add them to one of these locations in order for executors to pick them up.

## Add certificates to a binary deployment

> NOTE: see the [troubleshooting guide](/self-hosted/executors/executors-troubleshooting#connecting-to-cloud-provider-executor-instances) for instructions on how to connect to cloud provider VMs.

After successfully [deploying binaries](/self-hosted/executors/deploy-executors-binary), follow these steps:

1. Copy your certificates to `/etc/ssl/certs`.
1. If you are using systemd, run `systemctl restart executor`. If not, proceed to the next step.
1. Run `executor run` on the VM in order to restart the executor service.

### Add certificates with Firecracker

When running executors with the [firecracker runtime](/self-hosted/executors/firecracker), custom certificates need to be added in
the container that is running within the Firecracker VM. To add custom certificates, you must create a new Docker image
that contains the certificates. For example,

```dockerfile
FROM upstream:tag

# Copy the certificates into the container
COPY customcert.crt /usr/local/share/ca-certificates/customcert.crt
# Update the certificate store
RUN chmod 644 /usr/local/share/ca-certificates/customcert.crt && update-ca-certificates
# ...
```

#### Code navigation

Once the custom image is built, you can configure the executor to use it by setting
the `codeIntelAutoIndexing.indexerMap` to use the custom image. For example,

```json
"codeIntelAutoIndexing.indexerMap": {
  "go": "myregistry.company.com/scip-go:custom"
}
```

## Add certificates to a Kubernetes deployment using manifests

First, add the certificate data as a secret in your preferred namespace:

```shell
SECRET_NAME=custom-certs
CERT_PATH=/path/to/cert.pem
kubectl create secret generic $SECRET_NAME --from-file=customcert.crt=$CERT_PATH
```

Or as a declarative manifest:

```yaml
apiVersion: v1
kind: Secret
metadata:
    name: custom-certs
data:
    customcert.crt: $(base64 -i /path/to/cert.pem)
type: Opaque
```

Next, mount the secret in the executor deployment. Add the following snippet to `spec.template.spec.volumes` of each executor deployment:

```yaml
- name: custom-certs
  secret:
      secretName: custom-certs
```

Also add this snippet to `spec.template.spec.containers.volumeMounts` of each executor deployment (specifically, the executor container, in case you inject any sidecars):

```yaml
- mountPath: /etc/ssl/certs
  name: custom-certs
  readOnly: true
```

Next, apply the updated YAML manifests. Once the executors have rolled out, they should be picking up your custom certificates.

## Add certificates to a Kubernetes deployment using Helm

You may follow the same instructions for the manifest deployment to set custom certificates.

## Add certificates to a Docker Compose deployment

First, ensure that the certificate file is present on the host machine. Next, add the volume to the [executor compose file](https://sourcegraph.com/github.com/sourcegraph/deploy-sourcegraph-docker/-/blob/docker-compose/executors/executor.docker-compose.yaml?L26-30):

```yaml
- '/path/to/certs:/etc/ssl/certs'
```

Next, restart the deployment with `docker-compose down` and `docker-compose up -d`.