Use cert-manager to set up the certificate issuer that requires DNS or HTTP challenges and issue certificates to EonKube. The following DNS certificate authorities are supported:

• Vault
• Venafi
• ACME

Note:

• Make sure the DNS provider you are using is on the supported list of cert-manager.
• Such method involves external validation by doing domain validation (DNS or HTTP validation). Make sure this is OK to your business and organizations.
• High security requirements: In some environments, using an external free certificate provider may violate your security policy. In this case, it is suggested that you use an internal certification center.

Procedure

The following provides the example of ACME server and solves the DNS01 challenge.

Note:

When you use HTTP01 challenge, wildcard domain name certificate will not be supported.

The cert-manager has integrated with the following ACME issuer:

The cert-manager has integrated with the following ACME issuer:

• ACMEDNS
• Akamai
• AzureDNS
• CloudFlare
• Google
• Route53
• DigitalOcean
• RFC2136

If the provider you are using is not on the list above, use the third-party plugin and configure it using webhook. The following example uses Gandi.net and works with the plugin SINTEF/cert-manager-webhook-gandi.

1. Configure the DNS parameters for the cert-manager:
   1. To configure extraArgs in cert-manager and enable cert-manager to check DNS records, go to EonKube > Apps > Installed Apps.
   2. Search cert-manager.
   3. Click Edit/Upgrade.
   4. On the setting pages, click Next to proceed. On the editing page, click Add extraArgs parameters and click Upgrade in the bottom right-hand corner.
   5. Parameter:

      '--dns01-recursive-nameservers-only,--dns01-recursive-nameservers=8.8.8.8:53\,1.1.1.1:53}'

2. Download and install the cert-manager-webhook-gandi plugin:
   1. Download the plugin on github.
   2. Update the plugin:
      1. As the plugin is outdated and the API of Gandi is updated, when pulling requests on github to download the updated files, you must create a new plugin image.
      2. Fill the image and the required information in the values, YAML of the plugin helm chart.
   3. Install the plugin by using the following helm command:

      helm install cert-manager-webhook-gandi cert-manager-webhook-gandi/cert-manager-webhook-gandi \ --set gandiApiToken=<GANDI-API-KEY>

3. Configure a ClusterIssuer issuer:
   There are two kinds of issuer:
   • Issuer: The certificate's secret must reside in the same namespace.
   • ClusterIssuer: The certificate's secret can be used in the cluster.
   1. To create an Issuer, go to EonKube > More Resources > Cert Manager > Issuers.
   2. To create a ClusterIssuer, go to EonKube > More Resources > Cert Manager > ClusterIssuer.
   3. You can also click the Resource Search and search Issuer or ClusterIssuer.
   4. Click Create from YAML.
   5. Enter the following information:
      • kind: Specify the kind as Issuer or ClusterIssuer.
      • metadata.name: Specify the issuer name, e.g. letsencrypt-staging.
   6. The URL of the staging server is https://acme-staging-v02.api.letsencrypt.org/directory
      The URL of production server is https://acme-v02.api.letsencrypt.org/directory
      • namespace: Delete this command.
      • spec.acme.email: Specify the email address for applying for a certificate. It is usually the email address of the domain name owner.
      • spec.acme.privateKeySecretRef.name: Specify the Secret name of the certificate. It will be automatically generated after you specify one.
      • spec.acme.solvers.dns01.patSecretRef.key: Specify the file name of Gandi API key.
      • spec.acme.solvers.dns01.patSecretRef.name: Specify the Secret name of Gandi API key.
   7. Click Create.
4. Generate and replace the existing certificate:
   1. Go to EonKube > Service Discovery > Ingresses.
   2. The ingresses are listed according to the names of namespaces. Find the cattle-system. Click ⋮ and select Edit YAML.
   3. Change the following fields to the certificate information:
      • cert-manager.io/issuer: Specify the issuer name.
      • cert-manager.io/issuer-kind: Specify the kind as Issuer or ClusterIssuer.
      • cert-manager.io/cluster-issuer: Specify the issuer name. This is equivalent to cert-manager.io/issuer-kind:ClusterIssuer.
      • cert-manager.io/duration: Specify the validity period of the certificate in hours. The minimum value is 1 hour.
      • cert-manager.io/renewBefore: Specify when to renew the certificate in hours before it expires. The minimum value is 1 hour 1h.
   4. Save the settings.
   5. To verify if the certificate has been issued, go to More Resources > Cert Manager > Certificates. Find the certificate and check if the Ready status of it is True.