This message was deleted.
# generala
adamant-kite-43734
10/16/2023, 7:51 PMThis message was deleted.
r
refined-analyst-8898
10/16/2023, 7:51 PMThings I tried:
* external TLS option disables TLS termination in pod, but I want TLS termination with my own certificate
* letsencrypt option only creates an HTTP01 solver and assumes public ingress, no DNS01 solver which I'd need to obtain a 3rd party server cert without public ingress
* specifying existing TLS secret creates an unwanted Ingress resource with custom cert, not terminated in the pod
refined-analyst-8898
10/30/2023, 5:10 PMThe most direct paths to my goal would be having a DNS01 solver in Rancher or customizing the Ingress so that I can use a private GatewayClass or similar.
c
clever-analyst-23771
10/30/2023, 5:11 PM
I just brought this up with a collegue we are looking at this. but with kubecon we are all bit pressed with time at the moment.
👍 1
r
refined-analyst-8898
10/30/2023, 5:12 PMMaybe we can talk about it a little bit when we're there. ☺️
c
clever-analyst-23771
10/30/2023, 5:12 PM
That would be a great place to bring this up we are going to have an all star cast at the booth.
r
refined-analyst-8898
11/16/2023, 5:40 PM@wide-receptionist-90874 Not rushed, but I will give them a try if you have any ideas for configuring the Rancher chart with a custom TLS secret.
w
wide-receptionist-90874
11/29/2023, 4:15 PM
Is your certificate signed by cert-manager trusted? or are you using a private CA?
wide-receptionist-90874
11/29/2023, 4:59 PM
I haven't tried this myself but you may be able to shim your desired certificate + CA into the corresponding
tls-rancher-internal-catls-rancher-internalrancher.cattle-system.svcwide-receptionist-90874
11/29/2023, 5:01 PM
now, dynamic listener may try to update your
tls-rancher-internalr
refined-analyst-8898
11/29/2023, 5:58 PMI want to use a verifiable third party server certificate that I obtain via ACMEv2 with Cert Manager's DNS01 challenge solver. That avoids the need to expose my service to the web to obtain a certificate, since that would be the only reason to expose it at all.
refined-analyst-8898
11/29/2023, 6:00 PMIs dynamic listener part of Rancher?
w
wide-receptionist-90874
11/29/2023, 6:01 PM
yes, the dynamic listener is a component (it's a tls server) that listens for requests and dynamically updates/signs certificates that contain the requested hostname/IP in the cert SAN list
r
refined-analyst-8898
11/29/2023, 6:02 PMIs that the same component that implements ACMEv2's HTTP01 challenge solver and can obtain a server certificate from LetsEncrypt for Rancher Manager?
2 Views