CODEWITHSUNDEEP
sslkubernetesazure-akscert-manager
Nico Schuck
Nico Schuck

Reputation: 982

Cert-Manager provide own SSL Certificate for AKS

I want to use cert-manager for issuing my own SSL certificate on AKS.

I already have a signed certificate (https://www.quovadisglobal.de/Zertifikate/SSLCertificates/BusinessSSLCertificates.aspx) which I want to use. In the docs of cert-manager, I find only two relevant Solutions. https://cert-manager.io/docs/configuration/

SelfSigned: This should be used to sign a certificate by a CSR.

CA: This should be used to sign incoming certificate requests.

I tried the second one. Here what I did:

Install and verify cert-manager:

$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.12.0/cert-manager.yaml
$ kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-7c5748846c-b4nqb             1/1     Running   0          2d23h
cert-manager-cainjector-7b5965856-bgk4g   1/1     Running   1          2d23h
cert-manager-webhook-5759dd4547-mlgjs     1/1     Running   0          2d23h

Create Secret from private key and cert:

$ sudo kubectl create secret tls ssl-secret-p --cert=mycert.crt --key=mykey.key --namespace=cert-manager

Create issuer:

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: ca-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: ssl-secret-p

Error:

$ sudo kubectl get clusterissuers ca-issuer -n cert-manager -o wide

NAME        READY   STATUS                                                         AGE
ca-issuer   False   Error getting keypair for CA issuer: certificate is not a CA   5m

What I'm doing wrong?

EDIT:

sudo kubectl -n namespace get ing
NAME            HOSTS           ADDRESS          PORTS     AGE
nginx-ingress   ***.com         51.105.205.128   80, 443   13m

Upvotes: 0

Views: 1376

Answers (1)

Tushar Mahajan
Tushar Mahajan

Reputation: 2160

Cert manager will carry out the acme challenge verification, try passing this secret name to the tls in the ingress rule, once the acme challenge appears valid, you will see a corresponding entry in ingress 

kubectl -n namespace get ing

will give you that.

Then the certificate shall acquire ready state

I tried it, but I haven't used any pre-created tls secret. You can refer this stackoverflow post, I guess it turns up somewhat helpful to you

Upvotes: 1

Related Questions