• You have a ca-bundle, or single public certificates of your CA, which is used by the webproxy.

1. Take a look at the docker-compose.yml and the configuration of trivy-adapter. It looks something like this:

1. note the binding which mounts to and add your ca-bundle or the single public-certificates into the mount-location, by copying them.
2. (opt) if the host-path doesn’t fit for your case, you can also configure another path in the docker-compose file. be aware, that you might have to manually change this, if there are changes on new releases of trivy/harbor.

Depending on if you changed the path or not an update might overwrite the folder or mount from a different location. The following process makes sure, you don’t run into anything unexpected

1. backup your certificates to a folder, which is unrelated to harbor-configuration
2. upgrade harbor as always
3. check if the mount is the same as the folder where your certificates reside (normally ./common/config/shared/trust-certificates)
4. check if trivy is able to get CVE data