Create a Custom Route Certificate for Openshift 4
Sometimes we want to have a proper HTTPS certificate for our Openshift cluster, instead of a random Openshift generated certificate. We can do so by uploading our certificate into Openshift directly and completely replace default custom certificate.
But for this example, we are trying to generate a self-signed certificate with a custom attributes. We can start by generate a Root CA Key,
$ openssl genrsa -out rootCA.key 4096
After that we can create Root certificate based on previously generated rootCA.key
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt
Next is uploading our rootCA into Openshift 4
$ oc create configmap custom-ca --from-file=ca-bundle.crt=rootCA.crt -n openshift-config
And update cluster-wide proxy configuration to use our custom root certificate
$ oc patch proxy/cluster \
--type=merge \
--patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'
Next is to generate a certificate dedicated for our Openshift, we can start by generating a certificate key
$ openssl genrsa -out localhost.key 2048
and use the corresponding key to generate certificate signing,
$ openssl req -new -key localhost.key -out localhost.csr
last is to generate certificate using our CA Root key and CSR file,
$ openssl x509 -req -in localhost.csr -CA rootCA.crt -CAkey rootCA.key \ -CAcreateserial -out localhost.crt -days 1000 -sha256
We can verify the content of our CRT by using below command,
$ openssl x509 -in localhost.crt -text -noout
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
01:d3:65:36:30:4a:81:54:7d:ab:96:a5:a8:62:f2:d0:23:da:e7:6e
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = ID, ST = Jakarta, L = Jakarta, O = RH, OU = GPS, CN = localhost, emailAddress = edwin@redhat.com
Validity
Not Before: Oct 16 06:50:00 2023 GMT
Not After : Jul 12 06:50:00 2026 GMT
Subject: C = ID, ST = JKT, L = JKT, O = RH, OU = GPS, CN = edwin.baculsoft.com, emailAddress = edwin@redhat.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
.....
once we generated our self-signed certificate, we can deploy them to Openshift by using below command,
$ oc create secret tls tls-secret --cert=localhost.crt \ --key=localhost.key -n openshift-ingress
And patch our ingress operator to use our newly created secret,
$ oc patch ingresscontroller.operator default \
--type=merge -p '{"spec":{"defaultCertificate": {"name": "tls-secret"}}}' \
-n openshift-ingress-operator
We can validate whether our IngressController is reading our custom certificate by using below command,
$ oc get ingresscontroller default -oyaml
apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
creationTimestamp: "2023-06-20T05:04:35Z"
finalizers:
- ingresscontroller.operator.openshift.io/finalizer-ingresscontroller
generation: 2
name: default
namespace: openshift-ingress-operator
resourceVersion: "1025274"
uid: ab6a3f51-cc40-4d85-a988-568eb5358bc5
spec:
clientTLS:
clientCA:
name: ""
clientCertificatePolicy: ""
defaultCertificate:
name: tls-secret
And validate it by using CURL command,
$ curl -kv https://console-openshift-console.my-openshift.com/ * Trying [::1]:443... * Connected to console-openshift-console.my-openshift.com (::1) port 443 (#0) * ALPN: offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * (304) (IN), TLS handshake, Server hello (2): * (304) (IN), TLS handshake, Unknown (8): * (304) (IN), TLS handshake, Certificate (11): * (304) (IN), TLS handshake, CERT verify (15): * (304) (IN), TLS handshake, Finished (20): * (304) (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256 * ALPN: server did not agree on a protocol. Uses default. * Server certificate: * subject: C=ID; ST=JKT; L=JKT; O=RH; OU=GPS; CN=edwin.baculsoft.com; emailAddress=edwin@redhat.com * start date: Oct 16 05:52:53 2023 GMT * expire date: Feb 27 05:52:53 2025 GMT * issuer: C=ID; ST=Jakarta; L=Jakarta; O=RH; OU=GPS; CN=localhost; emailAddress=edwin@redhat.com * SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway. * using HTTP/1.x > GET / HTTP/1.1 > Host: console-openshift-console.my-openshift.com > User-Agent: curl/8.1.2 > Accept: */* > < HTTP/1.1 200 OK < referrer-policy: strict-origin-when-cross-origin < set-cookie: csrf-token=xxxxx < x-content-type-options: nosniff