Replacing the default ingress certificate

Understanding the default ingress certificate

By default, OKD uses the Ingress Operator to create an internal CA and issue a wildcard certificate that is valid for applications under the .apps sub-domain. Both the web console and CLI use this certificate as well.

The internal infrastructure CA certificates are self-signed. While this process might be perceived as bad practice by some security or PKI teams, any risk here is minimal. The only clients that implicitly trust these certificates are other components within the cluster. Replacing the default wildcard certificate with one that is issued by a public CA already included in the CA bundle as provided by the container userspace allows external clients to connect securely to applications running under the .apps sub-domain.

Replacing the default ingress certificate

You can replace the default ingress certificate for all applications under the .apps subdomain. After you replace the certificate, all applications, including the web console and CLI, will have encryption provided by specified certificate.

Prerequisites

  • You must have a wildcard certificate for the fully qualified .apps subdomain and its corresponding private key. Each should be in a separate PEM format file.

  • The private key must be unencrypted. If your key is encrypted, decrypt it before importing it into OKD.

  • The certificate must include the subjectAltName extension showing *.apps.<clustername>.<domain>.

  • The certificate file can contain one or more certificates in a chain. The wildcard certificate must be the first certificate in the file. It can then be followed with any intermediate certificates, and the file should end with the root CA certificate.

  • Copy the root CA certificate into an additional PEM format file.

Procedure

  1. Create a config map that includes only the root CA certificate used to sign the wildcard certificate:

    1. $ oc create configmap custom-ca \
    2.      --from-file=ca-bundle.crt=</path/to/example-ca.crt> \(1)
    3.      -n openshift-config
    1</path/to/example-ca.crt> is the path to the root CA certificate file on your local file system.

  2. Update the cluster-wide proxy configuration with the newly created config map:

    1. $ oc patch proxy/cluster \
    2.      --type=merge \
    3.      --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'

  3. Create a secret that contains the wildcard certificate chain and key:

    1. $ oc create secret tls <secret> \(1)
    2.      --cert=</path/to/cert.crt> \(2)
    3.      --key=</path/to/cert.key> \(3)
    4.      -n openshift-ingress
    1<secret> is the name of the secret that will contain the certificate chain and private key.
    2</path/to/cert.crt> is the path to the certificate chain on your local file system.
    3</path/to/cert.key> is the path to the private key associated with this certificate.

  4. Update the Ingress Controller configuration with the newly created secret:

    1. $ oc patch ingresscontroller.operator default \
    2.      --type=merge -p \
    3.      '{"spec":{"defaultCertificate": {"name": "<secret>"}}}' \(1)
    4.      -n openshift-ingress-operator
    1Replace <secret> with the name used for the secret in the previous step.

Additional resources