</code></pre></div><ul><li>Generate the Server Key, and Certificate and Sign with the CA Certificate:</li></ul><divclass=highlight><pre><span></span><code>openssl<spanclass=w></span>req<spanclass=w></span>-new<spanclass=w></span>-newkey<spanclass=w></span>rsa:4096<spanclass=w></span>-keyout<spanclass=w></span>server-key.der<spanclass=w></span>-out<spanclass=w></span>server.csr<spanclass=w></span>-nodes<spanclass=w></span>-subj<spanclass=w></span><spanclass=s1>'/CN=mydomain.com'</span>
</code></pre></div><p><imgalt=📝class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@14.1.2/assets/svg/1f4dd.svgtitle=:memo:> The CN (Common Name) x.509 attribute for the server Certificate <strong><em>must</em></strong> match the dns hostname referenced in ingress definition, see example below.</p><ul><li>Generate the Client Key, and Certificate and Sign with the CA Certificate:</li></ul><divclass=highlight><pre><span></span><code>openssl<spanclass=w></span>req<spanclass=w></span>-new<spanclass=w></span>-newkey<spanclass=w></span>rsa:4096<spanclass=w></span>-keyout<spanclass=w></span>client-key.der<spanclass=w></span>-out<spanclass=w></span>client.csr<spanclass=w></span>-nodes<spanclass=w></span>-subj<spanclass=w></span><spanclass=s1>'/CN=My Client'</span>
</code></pre></div><h2id=2-import-certificates-keys-to-kubernetes-secret-backend>2. Import Certificates / Keys to Kubernetes Secret-Backend<aclass=headerlinkhref=#2-import-certificates-keys-to-kubernetes-secret-backendtitle="Permanent link"> ¶</a></h2><ul><li>Convert all files specified in 1) from .der (binary format) to .pem (base64 encoded):</li></ul><divclass=highlight><pre><span></span><code>openssl<spanclass=w></span>x509<spanclass=w></span>-in<spanclass=w></span>certificate.der<spanclass=w></span>-inform<spanclass=w></span>der<spanclass=w></span>-out<spanclass=w></span>certificate.crt<spanclass=w></span>-outform<spanclass=w></span>pem
</code></pre></div><p><imgalt=❗class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@14.1.2/assets/svg/2757.svgtitle=:exclamation:> Kubernetes Web-Services import relies on .pem Base64-encoded format.</p><p><imgalt=⚡class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@14.1.2/assets/svg/26a1.svgtitle=:zap:> There is no need to import the CA Private Key, the Private Key is used only to sign new Client Certificates by the CA.</p><ul><li>Import the CA Certificate as Kubernetes sub-type <code>generic/ca.crt</code></li></ul><divclass=highlight><pre><span></span><code>kubectl<spanclass=w></span>create<spanclass=w></span>secret<spanclass=w></span>generic<spanclass=w></span>ca-secret<spanclass=w></span>--from-file<spanclass=o>=</span>ca.crt<spanclass=o>=</span>./ca-cert.pem
</code></pre></div><ul><li>Import the Server Certificate and Key as Kubernetes sub-type <code>tls</code> for transport layer</li></ul><divclass=highlight><pre><span></span><code>kubectl<spanclass=w></span>create<spanclass=w></span>secret<spanclass=w></span>tls<spanclass=w></span>tls-secret<spanclass=w></span>--cert<spanclass=w></span>./server-cert.pem<spanclass=w></span>--key<spanclass=w></span>./server-key.pem
</code></pre></div><ul><li>Optional import CA-cert, Server-cert and Server-Key for TLS and Client-Auth</li></ul><divclass=highlight><pre><span></span><code>kubectl<spanclass=w></span>create<spanclass=w></span>secret<spanclass=w></span>generic<spanclass=w></span>tls-and-auth<spanclass=w></span>--from-file<spanclass=o>=</span>tls.crt<spanclass=o>=</span>./server-crt.pem<spanclass=w></span>--from-file<spanclass=o>=</span>tls.key<spanclass=o>=</span>./server-key.pem<spanclass=w></span>--from-file<spanclass=o>=</span>ca.crt<spanclass=o>=</span>./ca-cert.pem
</code></pre></div><ul><li>Optional import a CRL (Certificate Revocation List)</li></ul><divclass=highlight><pre><span></span><code>kubectl<spanclass=w></span>create<spanclass=w></span>secret<spanclass=w></span>generic<spanclass=w></span>ca-secret<spanclass=w></span>--from-file<spanclass=o>=</span>ca.crt<spanclass=o>=</span>./ca-cert.pem<spanclass=w></span>--from-file<spanclass=o>=</span>ca.crl<spanclass=o>=</span>./ca-crl.pem
</code></pre></div><h2id=3-annotations-ingress-reference>3. Annotations / Ingress-Reference<aclass=headerlinkhref=#3-annotations-ingress-referencetitle="Permanent link"> ¶</a></h2><p>Now we are able to reference the created secrets in the ingress definition.</p><p><imgalt=📝class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@14.1.2/assets/svg/1f4dd.svgtitle=:memo:> The CA Certificate "authentication" will be reference in annotations.</p><table><thead><tr><th>Annotation</th><th>Description</th><th>Remark</th></tr></thead><tbody><tr><td>nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"</td><td>Activate Client-Auth</td><td>If "on", verify client Certificate</td></tr><tr><td>nginx.ingress.kubernetes.io/auth-tls-secret: "namespace/ca-secret"</td><td>CA "secret" reference</td><td>Secret namespace and service / ingress namespace must match</td></tr><tr><td>nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"</td><td>CA "chain" depth</td><td>How many CA levels should be processed</td></tr><tr><td>nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"</td><td>Pass Cert / Header</td><td>Pass Certificate to Web-App for e.g. parsing Client E-Mail Address x.509 Property</td></tr></tbody></table><p><imgalt=📝class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@14.1.2/assets/svg/1f4dd.svgtitle=:memo:> The Server Certificate for transport layer will be referenced in tls .yaml subsection.</p><divclass=highlight><pre><span></span><code><spanclass=nt>tls</span><spanclass=p>:</span>
</code></pre></div><h2id=4-example-test>4. Example / Test<aclass=headerlinkhref=#4-example-testtitle="Permanent link"> ¶</a></h2><p>The working .yaml Example: <ahref=ingress.yaml>ingress.yaml</a></p><ul><li>Test by performing a curl / wget against the Ingress Path without the Client Cert and expect a Status Code 400 (Bad Request - No required SSL certificate was sent).</li><li>Test by performing a curl / wget against the Ingress Path with the Client Cert and expect a Status Code 200.</li></ul><divclass=highlight><pre><span></span><code>wget<spanclass=w></span><spanclass=se>\</span>
</code></pre></div><h2id=5-remarks>5. Remarks<aclass=headerlinkhref=#5-remarkstitle="Permanent link"> ¶</a></h2><table><thead><tr><th><imgalt=❗class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@14.1.2/assets/svg/2757.svgtitle=:exclamation:> In future releases, CN verification seems to be "replaced" by SAN (Subject Alternate Name) for verrification, so do not forget to add</th></tr></thead><tbody><tr><td></td></tr></tbody></table><divclass=highlight><pre><span></span><code>openssl<spanclass=w></span>req<spanclass=w></span>-addext<spanclass=w></span><spanclass=s2>"subjectAltName = DNS:mydomain.com"</span><spanclass=w></span>...
</code></pre></div></article></div></div></main><footerclass=md-footer><divclass="md-footer-meta md-typeset"><divclass="md-footer-meta__inner md-grid"><divclass=md-copyright> Made with <ahref=https://squidfunk.github.io/mkdocs-material/target=_blankrel=noopener> Material for MkDocs </a></div></div></div></footer></div><divclass=md-dialogdata-md-component=dialog><divclass="md-dialog__inner md-typeset"></div></div><scriptid=__configtype=application/json>{"base":"../../..","features":["navigation.tabs","navigation.tabs.sticky","navigation.instant","navigation.sections"],"search":"../../../assets/javascripts/workers/search.f886a092.min.js","translations":{"clipboard.copied":"Copied to clipboard","clipboard.copy":"Copy to clipboard","search.result.more.one":"1 more on this page","search.result.more.other":"# more on this page","search.result.none":"No matching documents","search.result.one":"1 matching document","search.result.other":"# matching documents","search.result.placeholder":"Type to start searching","search.result.term.missing":"Missing","select.version":"Select version"}}</script><scriptsrc=../../../assets/javascripts/bundle.aecac24b.min.js></script></body></html>
