Generating your own mTLS root certificates

In order to support mTLS connections between meshedpods, Linkerd needs a trust anchor certificate andan issuer certificate with its corresponding key.

When installing with linkerd install, these certificates are automaticallygenerated. Alternatively, you can specify your own with the —identity-* flags(see the linkerd install reference).

On the other hand when using Helm to install Linkerd, it's not possible toautomatically generate them and you're required to provide them.

You can generate these certificates using a tool like openssl orstep. All certificates must use the ECDSA P-256algorithm which is the default for step. To generate ECDSA P-256 certificateswith openssl, you can use the openssl ecparam -name prime256v1 command. Inthis tutorial, we'll walk you through how to to use the step CLI to do this.

Generating the certificates with step

First generate the root certificate with its private key (using step version0.10.1):

step certificate create identity.linkerd.cluster.local ca.crt ca.key --profile root-ca --no-password --insecure

This generates the ca.crt and ca.key files. The ca.crt file is what youneed to pass to the —identity-trust-anchors-file option when installingLinkerd with the CLI, and the global.identityTrustAnchorsPEM value when installingLinkerd with Helm.

Note we use —no-password —insecure to avoid encrypting those files with apassphrase.

Then generate the intermediate certificate and key pair that will be used tosign the Linkerd proxies’ CSR.

step certificate create identity.linkerd.cluster.local issuer.crt issuer.key --ca ca.crt --ca-key ca.key --profile intermediate-ca --not-after 8760h --no-password --insecure

This will generate the issuer.crt and issuer.key files.

Passing the certificates to Linkerd

You can finally provide these files when installing Linkerd with the CLI:

linkerd install \
  --identity-trust-anchors-file ca.crt \
  --identity-issuer-certificate-file issuer.crt \
  --identity-issuer-key-file issuer.key \
  | kubectl apply -f -

Or when installing with Helm:

helm install \
  --set-file global.identityTrustAnchorsPEM=ca.crt \
  --set-file identity.issuer.tls.crtPEM=issuer.crt \
  --set-file identity.issuer.tls.keyPEM=issuer.key \
  --set identity.issuer.crtExpiry=$(date -d '+8760 hour' +"%Y-%m-%dT%H:%M:%SZ") \
  charts/linkerd2