Ca.crt and staging env

michael.cico · August 1, 2023, 12:51pm

I think this was all my bad. ACME Issuers don't create a ca.crt field with the root signing CA as it's not part of the protocol.

github.com/cert-manager/cert-manager

Add ca.crt to TLS secret generated by ACME issuers

opened 02:23PM - 22 Apr 19 UTC

closed 12:59PM - 25 Apr 19 UTC

ajpauwels

help wanted kind/feature priority/backlog area/acme

**Is your feature request related to a problem? Please describe.** The `ca.crt`… field is added to the TLS secret generated by CA issuers, but is null for ACME issuers. **Describe the solution you'd like** The Issuer uses the Link header returned by the ACME protocol as defined by the ACME standard to fetch the issuer's cert and places it inside the TLS secret under the `ca.crt` key. **ACME standard** The `Link` header is mentioned in `Section 6.5 Certificate Issuance` of the ACME standard draft. Refer to the last paragraph on page 30 here: https://tools.ietf.org/html/draft-ietf-acme-acme-02 **Environment details (if applicable)**: - Kubernetes version (e.g. v1.10.2): v1.12 - Cloud-provider/provisioner (e.g. GKE, kops AWS, etc): AKS - cert-manager version (e.g. v0.4.0): v0.7.0 - Install method (e.g. helm or static manifests): static /kind feature

Topic		Replies	Views
Issues with using acme to get signed cert from staging servers Help	3	517	September 11, 2020
How can I apply CA for intranet website use Help	5	1924	May 4, 2021
Ccertificat ssl Help	5	411	February 12, 2021
Able to get Staging Cert but not in Production Help	13	2242	November 25, 2020
Get https://acme-staging-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout - kubernetes cert-manager Help	10	9533	August 31, 2019

Ca.crt and staging env

Related topics