SSL Configuration for Private Locations¶

By default, escape-cli uses your machine's system trust store, or the container's trust store when it's running in a container.

These settings apply to the agent's HTTPS connections to Escape (API calls, and the tunnel when you deploy with the HTTPS transport), for example behind a TLS-inspecting proxy. They don't configure TLS trust for your scan targets.

See Environment Variables for the defaults and the complete TLS configuration reference.

Allowing Insecure SSL Connections¶

Set ESCAPE_SSL_INSECURE="true" to skip TLS certificate verification for the agent's HTTPS connections to Escape.

Configuring Custom SSL CA Certificates¶

Set ESCAPE_SSL_CERT_PATH to a PEM bundle of trusted CA certificates. This replaces the system roots, so the bundle must include every CA needed to reach Escape's endpoints through your network.

Single CA Certificate¶

To use a single CA certificate, set ESCAPE_SSL_CERT_PATH to its file path:

services:
  private-location:
    image: escapetech/cli:latest
    environment:
      - ESCAPE_API_KEY=<ESCAPE_API_KEY>
      - ESCAPE_SSL_CERT_PATH=/certs/custom-ca.pem
    volumes:
      - ./certs:/certs

Multiple CA Certificates¶

The ESCAPE_SSL_CERT_PATH variable supports PEM files containing multiple CA certificates. To configure multiple CA certificates, concatenate them into a single PEM file with each certificate in standard PEM format:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKJ...
(first CA certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEBzCCAu+gAwIBAgICEA...
(second CA certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFBjCCA+6gAwIBAgIQdY...
(third CA certificate)
-----END CERTIFICATE-----

Then reference this combined certificate file:

services:
  private-location:
    image: escapetech/cli:latest
    environment:
      - ESCAPE_API_KEY=<ESCAPE_API_KEY>
      - ESCAPE_SSL_CERT_PATH=/certs/combined-ca-bundle.pem
    volumes:
      - ./certs:/certs