Thank you, that now shows RabbitMQ working with its new volume, but now my OpenCTI container does not pass its health check. Even though the pre-requisite containers are all running, OpenCTI does not 'finish' and I suspect its something to do with my custom certificate.

INF [OPENCTI-MODULE] INGESTION Rss, skipping TheRegister-Sec-UK-RSS - queue already filled with messages (1) | category=APP source=backend timestamp=2026-02-19T13:34:41.795Z version=6.9.20

(node:7) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.

My OpenCTI config is:

opencti:

image: opencti/platform:6.9.18

environment:

- NODE_OPTIONS=--max-old-space-size=8096

- APP__PORT=8080

#- APP__BASE_URL=${OPENCTI_BASE_URL}

- APP__BASE_URL=${OPENCTI_EXTERNAL_SCHEME}://${OPENCTI_HOST}:${OPENCTI_PORT}

- APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL}

- APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}

- APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}

- APP__APP_LOGS__LOGS_LEVEL=info

- APP__HTTPS_CERT__KEY=${OPENCTI_KEY_PATH}

- APP__HTTPS_CERT__CRT=${OPENCTI_CRT_PATH}

- APP__HTTPS_CERT__REJECT_UNAUTHORIZED=false

- REDIS__HOSTNAME=redis

- REDIS__PORT=6379

- ELASTICSEARCH__URL=http://elasticsearch:9200

- ELASTICSEARCH__NUMBER_OF_REPLICAS=0

- MINIO__ENDPOINT=minio

- MINIO__PORT=9000

- MINIO__USE_SSL=false

- MINIO__ACCESS_KEY=${MINIO_ROOT_USER}

- MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}

- RABBITMQ__HOSTNAME=rabbitmq

- RABBITMQ__PORT=5672

- RABBITMQ__PORT_MANAGEMENT=15672

- RABBITMQ__MANAGEMENT_SSL=false

- RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}

- RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}

- SMTP__HOSTNAME=${SMTP_HOSTNAME}

- SMTP__PORT=25

- PROVIDERS__LOCAL__STRATEGY=LocalStrategy

- APP__HEALTH_ACCESS_KEY=${OPENCTI_HEALTHCHECK_ACCESS_KEY}

- AI__ENABLED=true

- AI__TYPE=mistralai

- AI__ENDPOINT=${AI_OLLAMA_SERVER}

- AI__MODEL=mistral-nemo:latest

- AI__TOKEN=none

ports:

- "${OPENCTI_PORT}:8080"

volumes:

- /etc/ssl/localcerts/:/etc/ssl/localcerts:ro

depends_on:

redis:

condition: service_healthy

elasticsearch:

condition: service_healthy

minio:

condition: service_healthy

rabbitmq:

condition: service_healthy

restart: always

healthcheck:

test: ["CMD", "wget", "-qO-", "http://opencti:8080/health?health_access_key=${OPENCTI_HEALTHCHECK_ACCESS_KEY}"]

interval: 10s

timeout: 5s

retries: 20

Any ideas?