New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.14

v26.4.14​

Ory Keto and Ory Oathkeeper verify TLS with a built-in root certificate bundle​

The Ory Enterprise License (OEL) images of Ory Keto Permissions and Ory Oathkeeper IAM Proxy now verify outbound TLS connections against Mozilla's root certificate authorities (CAs), which are built into the binary. Ory Kratos Identities, Ory Hydra Authorization, and Ory Talos Secure API Keys already work this way. The services no longer read the CA bundle of the container image, and they ignore a bundle in SSL_CERT_FILE or SSL_CERT_DIR by default.

Breaking changes​

If Ory Keto Permissions or Ory Oathkeeper IAM Proxy calls an endpoint that uses a certificate from a private CA, the call now fails with x509: certificate signed by unknown authority. For Ory Oathkeeper IAM Proxy, this includes token introspection, JWKS, and remote authorizer endpoints. To keep trusting your private CA, set GODEBUG=x509usefallbackroots=0 together with SSL_CERT_FILE or SSL_CERT_DIR. Your bundle must also contain the public root CAs that the service needs. See Trust a private certificate authority.