</code></pre></div><p>Then, you can concatenate them all in only one file, named 'ca.crt' as the following:</p><divclass=highlight><pre><span></span><code>cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
</code></pre></div><p><strong>Note:</strong> Make sure that the Key Size is greater than 1024 and Hashing Algorithm(Digest) is something better than md5 for each certificate generated. Otherwise you will receive an error.</p><h2id=creating-certificate-secrets>Creating Certificate Secrets<aclass=headerlinkhref=#creating-certificate-secretstitle="Permanent link"> ¶</a></h2><p>There are many different ways of configuring your secrets to enable Client-Certificate Authentication to work properly.</p><ol><li><p>You can create a secret containing just the CA certificate and another Secret containing the Server Certificate which is Signed by the CA.</p><divclass=highlight><pre><span></span><code>kubectl create secret generic ca-secret --from-file<spanclass=o>=</span>ca.crt<spanclass=o>=</span>ca.crt
</code></pre></div></li><li><p>You can create a secret containing CA certificate along with the Server Certificate, that can be used for both TLS and Client Auth.</p><divclass=highlight><pre><span></span><code>kubectl create secret generic ca-secret --from-file<spanclass=o>=</span>tls.crt<spanclass=o>=</span>server.crt --from-file<spanclass=o>=</span>tls.key<spanclass=o>=</span>server.key --from-file<spanclass=o>=</span>ca.crt<spanclass=o>=</span>ca.crt
</code></pre></div></li><li><p>If you want to also enable Certificate Revocation List verification you can create the secret also containing the CRL file in PEM format: <divclass=highlight><pre><span></span><code>kubectl create secret generic ca-secret --from-file<spanclass=o>=</span>ca.crt<spanclass=o>=</span>ca.crt --from-file<spanclass=o>=</span>ca.crl<spanclass=o>=</span>ca.crl
</code></pre></div></p></li></ol><p>Note: The CA Certificate must contain the trusted certificate authority chain to verify client certificates.</p><h2id=setup-instructions>Setup Instructions<aclass=headerlinkhref=#setup-instructionstitle="Permanent link"> ¶</a></h2><ol><li>Add the annotations as provided in the <ahref=ingress.yaml>ingress.yaml</a> example to your own ingress resources as required.</li><li>Test by performing a curl against the Ingress Path without the Client Cert and expect a Status Code 400.</li><li>Test by performing a curl against the Ingress Path with the Client Cert and expect a Status Code 200.</li></ol></article></div></div></main><footerclass=md-footer><divclass=md-footer-nav><navclass="md-footer-nav__inner md-grid"aria-label=Footer><ahref=../basic/class="md-footer-nav__link md-footer-nav__link--prev"rel=prev><divclass="md-footer-nav__button md-icon"><svgxmlns=http://www.w3.org/2000/svgviewbox="0 0 24 24"><pathd="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg></div><divclass=md-footer-nav__title><divclass=md-ellipsis><spanclass=md-footer-nav__direction> Previous </span> Basic Authentication </div></div></a><ahref=../external-auth/class="md-footer-nav__link md-footer-nav__link--next"rel=next><divclass=md-footer-nav__title><divclass=md-ellipsis><spanclass=md-footer-nav__direction> Next </span> External Basic Authentication </div></div><divclass="md-footer-nav__button md-icon"><svgxmlns=http://www.w3.org/2000/svgviewbox="0 0 24 24"><pathd="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg></div></a></nav></div><divclass="md-footer-meta md-typeset"><divclass="md-footer-meta__inner md-grid"><divclass=md-footer-copyright> Made with <ahref=https://squidfunk.github.io/mkdocs-material/target=_blankrel=noopener> Material for MkDocs </a></div></div></div></footer></div><scriptsrc=../../../assets/javascripts/vendor.93c04032.min.js></script><scriptsrc=../../../assets/javascripts/bundle.83e5331e.min.js></script><scriptid=__langtype=application/json>{"clipboard.copy":"Copy to clipboard","clipboard.copied":"Copied to clipboard","search.config.lang":"en","search.config.pipeline":"trimmer, stopWordFilter","search.config.separator":"[\\s\\-]+","search.placeholder":"Search","search.result.placeholder":"Type to start searching","search.result.none":"No matching documents","search.result.one":"1 matching document","search.result.other":"# matching documents","search.result.more.one":"1 more on this page","search.result.more.other":"# more on this page","search.result.term.missing":"Missing"}</script><script>
