Use a custom CA for Red Hat Edge Manager service certificates

Use a corporate certificate authority (CA) to sign Red Hat Edge Manager service Transport Layer Security (TLS) certificates on Red Hat OpenShift Container Platform instead of the default self-signed CA.

By default, when the Red Hat Edge Manager installer detects cert-manager on the cluster, it creates a namespace-scoped self-signed CA. This CA signs service certificates for the API, web UI, telemetry, and image builder. To integrate with an existing corporate PKI, pre-create the flightctl-ca secret so the installer uses your CA instead.

Note

Configuring global.auth.caCert with the cluster ingress CA bundle tells edge devices and the Flight Control CLI which CA to trust when they verify the Red Hat Edge Manager API route. That setting is separate from flightctl-ca, which controls which CA signs Red Hat Edge Manager internal service certificates. You might need both settings in enterprise deployments.

 Important

Agent and enrollment client certificates are signed by the Red Hat Edge Manager-managed Client-Signer CA (flightctl-client-signer-ca), not directly by your corporate ClusterIssuer. Your custom CA signs Red Hat Edge Manager service certificates and the Client-Signer intermediate CA; device mTLS certificates remain under Red Hat Edge Manager certificate management.

Before you configure a custom CA, ensure that the following prerequisites are met:

  • Red Hat OpenShift Container Platform 4.19 or later and cluster administrator permissions.
  • An installation namespace (OpenShift project) already exists. Create the project before you create the flightctl-ca secret.
  • The cert-manager Operator is installed on the cluster when you use the cert-manager procedure below. Install it from Ecosystem Software Catalog before you deploy Red Hat Edge Manager.
  • When you use the cert-manager procedure below, a ClusterIssuer or Issuer is already configured and reports Ready: True.
  • Your CA can sign other certificates (it is a CA certificate, not a leaf certificate).