</code></pre></div><p>Note: If using CA Authentication, described below, you will need to sign the server certificate with the CA.</p><h2id=client-certificate-authentication>Client Certificate Authentication<aclass=headerlinkhref=#client-certificate-authenticationtitle="Permanent link"> ¶</a></h2><p>CA Authentication also known as Mutual Authentication allows both the server and client to verify each others identity via a common CA.</p><p>We have a CA Certificate which we obtain usually from a Certificate Authority and use that to sign both our server certificate and client certificate. Then every time we want to access our backend, we must pass the client certificate.</p><p>These instructions are based on the following <ahref=https://medium.com/@awkwardferny/configuring-certificate-based-mutual-authentication-with-kubernetes-ingress-nginx-20e7e38fdfca>blog</a></p><p><strong>Generate the CA Key and Certificate:</strong></p><divclass=highlight><pre><span></span><code><spanclass=go>openssl req -x509 -sha256 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 356 -nodes -subj '/CN=My Cert Authority'</span>
</code></pre></div><p><strong>Generate the Server Key, and Certificate and Sign with the CA Certificate:</strong></p><divclass=highlight><pre><span></span><code><spanclass=go>openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -nodes -subj '/CN=mydomain.com'</span>
</code></pre></div><p><strong>Generate the Client Key, and Certificate and Sign with the CA Certificate:</strong></p><divclass=highlight><pre><span></span><code><spanclass=go>openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -nodes -subj '/CN=My Client'</span>
</code></pre></div><p>Once this is complete you can continue to follow the instructions <ahref=../auth/client-certs/#creating-certificate-secrets>here</a></p><h2id=test-http-service>Test HTTP Service<aclass=headerlinkhref=#test-http-servicetitle="Permanent link"> ¶</a></h2><p>All examples that require a test HTTP Service use the standard http-svc pod, which you can deploy as follows</p><divclass=highlight><pre><span></span><code><spanclass=gp>$</span> kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/http-svc.yaml
</code></pre></div><p>You can test that the HTTP Service works by exposing it temporarily</p><divclass=highlight><pre><span></span><code><spanclass=gp>$</span> kubectl patch svc http-svc -p <spanclass=s1>'{"spec":{"type": "LoadBalancer"}}'</span>
</code></pre></div></article></div></div></main><footerclass=md-footer><divclass=md-footer-nav><navclass="md-footer-nav__inner md-grid"aria-label=Footer><ahref=../class="md-footer-nav__link md-footer-nav__link--prev"rel=prev><divclass="md-footer-nav__button md-icon"><svgxmlns=http://www.w3.org/2000/svgviewbox="0 0 24 24"><pathd="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg></div><divclass=md-footer-nav__title><divclass=md-ellipsis><spanclass=md-footer-nav__direction> Previous </span> Introduction </div></div></a><ahref=../affinity/cookie/class="md-footer-nav__link md-footer-nav__link--next"rel=next><divclass=md-footer-nav__title><divclass=md-ellipsis><spanclass=md-footer-nav__direction> Next </span> Sticky Sessions </div></div><divclass="md-footer-nav__button md-icon"><svgxmlns=http://www.w3.org/2000/svgviewbox="0 0 24 24"><pathd="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg></div></a></nav></div><divclass="md-footer-meta md-typeset"><divclass="md-footer-meta__inner md-grid"><divclass=md-footer-copyright> Made with <ahref=https://squidfunk.github.io/mkdocs-material/target=_blankrel=noopener> Material for MkDocs </a></div></div></div></footer></div><scriptsrc=../../assets/javascripts/vendor.93c04032.min.js></script><scriptsrc=../../assets/javascripts/bundle.83e5331e.min.js></script><scriptid=__langtype=application/json>{"clipboard.copy":"Copy to clipboard","clipboard.copied":"Copied to clipboard","search.config.lang":"en","search.config.pipeline":"trimmer, stopWordFilter","search.config.separator":"[\\s\\-]+","search.placeholder":"Search","search.result.placeholder":"Type to start searching","search.result.none":"No matching documents","search.result.one":"1 matching document","search.result.other":"# matching documents","search.result.more.one":"1 more on this page","search.result.more.other":"# more on this page","search.result.term.missing":"Missing"}</script><script>
