Attach SSL certificate for site from key vault secret to AKS

Question

Attach SSL certificate for site from key vault secret to AKS

p.shapurau 16

Created a wildcard certificate in openwork. Synchronized with the key vault, a secret is automatically created there. All checkboxes are green, everything is ok! This secret is created in aks in the corresponding namespace in a secret like kubernetes.io/tls (using akv2k8s). Synchronization occurs, everything is ok. Crt and key I see. I attach this secret to the ingress in the rules and tls section to the host (hostname with the appropriate name for the domain) and writes that fake Certificate and substitutes the default "Acme Co, Kubernetes Ingress Controller Fake Certificate", in the ingress logs "Error getting Ssl certificate, local ssl certificate not found. Using default certificate. "What should I do? Why does not it work?

Pierre-Luc Giguere 1,076 Reputation points

2021-11-10T14:54:53.183+00:00

Hi P.

I am no guru with AKS so this won't be an answer but a comment on what we did in the past that helped us implement certificates.

We basically followed these steps: https://github.com/fbeltrao/aks-letsencrypt/blob/master/setup-wildcard-certificates-with-azure-dns.md

Turned out that we did not notice we were deploying in a new namespace and hence the certificate wasn't working since it needs to be in the same namespace since it's a wildcard.

Again, not offering an answer here but maybe a path to figuring out your problem.
p.shapurau 16 Reputation points

2021-11-11T07:16:46.337+00:00

Thank's

I have tried in the same space as well. It doesn't help, the result is the same.
p.shapurau 16 Reputation points

2021-11-11T08:30:02.467+00:00

I also checked another option. A truly self-signed certificate works, but Azure wildcard certificate for a domain does not work that way.

1 answer

Your answer

Pierre-Luc Giguere 1,076 Reputation points

2021-11-10T14:54:53.183+00:00

Hi P.

I am no guru with AKS so this won't be an answer but a comment on what we did in the past that helped us implement certificates.

We basically followed these steps: https://github.com/fbeltrao/aks-letsencrypt/blob/master/setup-wildcard-certificates-with-azure-dns.md

Turned out that we did not notice we were deploying in a new namespace and hence the certificate wasn't working since it needs to be in the same namespace since it's a wildcard.

Again, not offering an answer here but maybe a path to figuring out your problem.
p.shapurau 16 Reputation points

2021-11-11T07:16:46.337+00:00

Thank's

I have tried in the same space as well. It doesn't help, the result is the same.
p.shapurau 16 Reputation points

2021-11-11T08:30:02.467+00:00

I also checked another option. A truly self-signed certificate works, but Azure wildcard certificate for a domain does not work that way.

Answer 1

p.shapurau 16

I seem to understand what the problem is. Double wildcard custom domains not supported by Azure today? Do I understand correctly?
My certificate was issued for *.mywebsite.com (in Azure), my applications in AKS are: aaa.bbb.mywebsite.com, because there are a lot of them.

If so, it creates very big problems for me.

Share via

Attach SSL certificate for site from key vault secret to AKS

1 answer

Your answer