...
| Code Block |
|---|
$ ssh azure4.onap.eu |
Certificate issues
cert-manager is responsible for handling certificates (issued by Let's Encrypt). In case of issues with certificates (like outdated ones) start with cert-manager logs analysis.
Up to now two issues occurred. After transferring ownership of onap.eu, cert-manager was unable to issue new certificates due to DNS challenge failing. This was solved by changing challenge method to DNS. It can be done in Issuer resource that is responsible for requesting new certificates from Let's Encrypt. After changes solver section looks like this:
| Code Block | ||
|---|---|---|
| ||
solvers:
- http01:
ingress:
class: nginx |
Another issue that occurred was caused by two ingresses that are responsible for different subdomains using the same TLS secret. In this case solution was very simple - changing name of secret in ingress. After that cert-manager will automatically request for new certificate from Let's Encrypt and save it under new name. In order to make it work Ingress also needs following annotations to be present (in metadata section):
| Code Block | ||
|---|---|---|
| ||
metadata:
annotations:
kubernetes.io/ingress.class: "nginx"
cert-manager.io/issuer: "{{ name_of_responsible_issuer }}" |
Obviously {{ name_of_responsible_issuer }} should be changed to appropriate name if Issuer resource.