title: X509Chain Build failing on Alpine linux container in Azure Kubernetes Cluster with Istio
body: <p>I have a certificate which I am validating using X509Chain (<code>chain.Build(certificate)</code>). The certificate has an Intermediate CA X and a root Y, both of which are currently installed on my windows machine where I am testing.</p>
  <p>On my windows machine, the chain.Build() succeeds (assuming because both the CAs are present on my machine), but the same validation code fails to validate the certificate on my linux container.</p>
  <p>This is how my dockerfile looks like:</p>
  <pre><code># pull down the build container
  FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-alpine3.10
  
  WORKDIR /app
  
  # expose ports
  EXPOSE 443
  EXPOSE 80
  
  # Install cultures (same approach as Alpine SDK image)
  RUN apk add --no-cache icu-libs
  
  # Disable the invariant mode (set in base image)
  ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false
  
  # copy build output
  COPY . /app
  
  COPY ./Configuration/X.cer /usr/share/ca-certificates/X.crt
  COPY ./Configuration/Y.cer /usr/share/ca-certificates/Y.crt
  
  RUN echo &quot;X.crt&quot; &gt;&gt; /etc/ca-certificates.conf
  RUN echo &quot;Y.crt&quot; &gt;&gt; /etc/ca-certificates.conf
  
  RUN update-ca-certificates
  
  # start the service
  ENTRYPOINT [&quot;dotnet&quot;, &quot;ValidationService.dll&quot;]
  </code></pre>
  <p>I have exported the base64 encoded X509 cert from my machine and using that to copy to /usr/share/ca-certificates/.
  I make a manual entry into the ca-certificates.conf file in the etc folder and then run update-ca-certificates.
  Post deployment, I see the correct entries in the conf file in my container, and also in the ssl folder, with my cert being added there. But my validation is still failing.</p>
  <p>Not sure if I am missing any step here? Please advice.</p>