bluegrassstudio/selenium-chrome-node-ca-cert repository overview

By default, Selenium Chrome containers do not trust this CA, which causes:

	❌ TLS handshake failures
	❌ NET::ERR_CERT_AUTHORITY_INVALID errors in Chrome
	❌ Tests failing when routed through ZAP
	❌ Broken or incomplete security scans

	Loads the OWASP ZAP Root CA from a Docker config
	Imports it into Chrome’s NSS trust store for the seluser
	Starts Selenium using the official upstream entrypoint
	Registers cleanly with Selenium Grid / Hub

All without modifying test code or browser options.

Step 1: Export the ZAP Root CA
	From OWASP ZAP:
		UI:
		Tools → Options → Network → Server Certificates → Save
		
		Or file (default location varies):
		zap_root_ca.pem

Step 2: Create a Docker Config (Swarm / Portainer)

	docker config create zap_root_ca zap_root_ca.pem

Step 3: Mount the Config into the Selenium Node
	In your Swarm stack or Portainer service:
	
	configs:  
		- source: zap_root_ca
		  target: /run/configs/zap_root_ca
		  
That path must exist, otherwise the container will exit with a clear error.

services:  
	selenium-node-chrome:    
		image: your-dockerhub-user/selenium-node-zapca:1.0    
		deploy:      
			replicas: 1    
		configs:      
			- source: zap_root_ca        
			target: /run/configs/zap_root_ca    
		environment:      
			SE_EVENT_BUS_HOST: selenium-hub      
			SE_EVENT_BUS_PUBLISH_PORT: 4442      
			SE_EVENT_BUS_SUBSCRIBE_PORT: 4443

	Run OWASP ZAP as a proxy for Selenium tests
	Use HTTPS applications
	Deploy Selenium Grid using Docker Swarm / Portainer
	Want zero browser config, no --ignore-certificate-errors
	Need repeatable, CI-safe security automation

The CA must be PEM format
Only affects the container’s Chrome browser (no host changes)
Designed for Selenium 4.x (selenium/node-chrome)
Requires Docker configs (not secrets or env vars)