Create Certificates Locally using cert-manager on the Controller¶

You can use cert-manager to locally create certificates suitable for use in a lab environment.

Note

Starting with StarlingX Release r13, the default key type for platform certificates is ECDSA P-384. RSA keys (4096 bits or longer) are also supported.

You can check the key algorithm and length by running kubectl get secret <secret-name> -n <namespace> -o jsonpath='{.data.tls.crt}' | base64 -d | openssl x509 -noout -text and looking for Public-Key in the output. For more information, see Create Certificates Locally using openssl.

Procedure

Create a Root CA Certificate and Key.

Create a self-signing issuer.

$ echo "
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: my-selfsigning-issuer
spec:
  selfSigned: {}
" | kubectl apply -f -

Create a Root CA certificate and key.

$ echo "
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-rootca-certificate
spec:
  secretName: my-rootca-certificate
  commonName: "my-rootca"
  isCA: true
  privateKey:
    algorithm: ECDSA
    size: 384
  issuerRef:
    name: my-selfsigning-issuer
    kind: Issuer
" | kubectl apply -f -

The privateKey.algorithm and privateKey.size fields can be changed to use RSA (e.g. algorithm: RSA, size: 4096) if required.

Create a Root CA Issuer.

$ echo "
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: my-rootca-issuer
spec:
  ca:
    secretName: my-rootca-certificate
" | kubectl apply -f -

Create files for the Root CA certificate and key.

$ kubectl get secret my-rootca-certificate -o yaml | egrep "^  tls.crt:" | awk '{print $2}' | base64 --decode > my-rootca-cert.pem
$ kubectl get secret my-rootca-certificate -o yaml | egrep "^  tls.key:" | awk '{print $2}' | base64 --decode > my-rootca-key.pem

Create and sign a Server Certificate and Key.
1. Create the Server certificate and key.
```
$ echo "
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-server-certificate
spec:
  secretName: my-server-certificate
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: 1.1.1.1
  privateKey:
    algorithm: ECDSA
    size: 384
  dnsNames:
  - myserver.wrs.com
  ipAddresses:
  - 1.1.1.1
  issuerRef:
    name: my-rootca-issuer
    kind: Issuer
" | kubectl apply -f -
```
  Note
  
  The Certificate usage of Cert-manager Documentation (https://cert-manager.io/docs/usage/certificate/) states that one should “Take care when setting the renewBefore field to be very close to the duration as this can lead to a renewal loop, where the Certificate is always in the renewal period.”
  
  Considering the statement above, you must not set renewBefore to a value very close to the duration value, such as a renewBefore of 29 days and a duration of 30 days. Instead, you could set values such as renewBefore=15 days and duration=30 days to avoid renewal loops.
2. Create the PEM files for Server certificate and key.
```
$ kubectl get secret my-server-certificate -o yaml | egrep "^  tls.crt:" | awk '{print $2}' | base64 --decode > my-server-cert.pem
$ kubectl get secret my-server-certificate -o yaml | egrep "^  tls.key:" | awk '{print $2}' | base64 --decode > my-server-key.pem
```
3. Combine the server certificate and key into a single file.
```
$ cat my-server-cert.pem my-server-key.pem > my-server.pem
```