Update load-ca.sh

load-ca.sh

@@ -1,17 +1,25 @@
+# 改进的load-ca.sh脚本
 #!/bin/sh
 
-# 将环境变量中的证书内容写入文件
-echo "$CA_CERT_CONTENT" | sed 's/\\n/\n/g' > /certs/custom/db-ca.crt
+# 创建目标目录（防止父目录不存在）
+mkdir -p /certs/custom || exit 1
+
+# 转换环境变量为证书文件
+echo "${CA_CERT_CONTENT}" | awk '{gsub(/\\n/,"\n")}1' > /certs/custom/db-ca.crt
 
 # 验证证书有效性
-if ! openssl x509 -in /certs/custom/db-ca.crt -noout; then
-  echo "Invalid CA certificate format"
+if ! /usr/bin/openssl x509 -in /certs/custom/db-ca.crt -noout 2>/dev/null; then
+  echo "ERROR: Invalid certificate format. Actual certificate content:"
+  cat /certs/custom/db-ca.crt
   exit 1
 fi
 
-# 添加到系统信任链
+# 添加到系统证书链
 cp /certs/custom/db-ca.crt /usr/local/share/ca-certificates/
-update-ca-certificates
+update-ca-certificates --fresh
+
+# 权限修正（适配非root用户）
+chmod 644 /etc/ssl/certs/*.pem 2>/dev/null || true
 
-# 执行原始ENTRYPOINT
-exec "$@"
+# 执行原始入口命令
+exec "$@"