Create custom certificate authorities for TLS

Create custom certificate authorities for TLS to manage your own certificates for ingress and internal endpoints, ensuring compliance with your organization’s PKI requirements.

An issuer is a resource that acts as a certificate authority for a specific namespace. TLS-e (TLS everywhere) uses the following issuers by default:

  • rootca-internal
  • rootca-libvirt
  • rootca-ovn
  • rootca-public

Create a custom cert-manager issuer
Copy link

Create a custom cert-manager issuer so that TLS certificates for your ingress or internal endpoints comply with your organization’s security policies or integrate with your existing PKI infrastructure.

About this task
Copy link

To manage your own certificates for internal endpoints, you must create a custom internal issuer. TLS-e uses the following issuers by default:

  • rootca-internal
  • rootca-libvirt
  • rootca-ovn
  • rootca-public

Procedure
Copy link

  1. Create a custom issuer in a file named rootca-custom.yaml: 
    apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: <issuer_name>
spec:
  ca:
    secretName: <secret_name>

    where:

    <issuer_name>
    Specifies the name of your custom issuer, for example, rootca-ingress-custom.
    <secret_name>
    Specifies the name of the Secret CR used by the certificate for your custom issuer. If you do not include a secret, one is created automatically.
  2. Create a certificate in a file named ca-issuer-certificate.yaml: 
    apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: <issuer_name>
spec:
  commonName: <issuer_name>
  isCA: true
  duration: <hours>
  privateKey:
    algorithm: RSA
    size: 3072
  issuerRef:
    name: selfsigned-issuer
    kind: Issuer
  secretName: <secret-name>

    where:

    <issuer_name>
    Specifies the name of your custom issuer. This matches the issuer created in the first step.
    <hours>
    Specifies the duration in hours, for example, a value of 87600h is equivalent to 3650 days, or about 10 years.
    <secret_name>
    Specifies the name of the Secret CR used by the certificate for your custom issuer. If you do not include a secret, one is created automatically.
  3. Create the issuer and certificate: 
    $ oc create -f rootca-custom.yaml
$ oc create -f ca-issuer-certificate.yaml
  4. Add the custom issuer to the TLS service definition in the control plane CR file.
    1. If your custom issuer is an ingress issuer, the customer issuer is defined under the ingress attribute as shown below: 
      apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: openstack-control-plane
spec:
  tls:
     ingress:
       enabled: true
       ca:
         customIssuer: <issuer_name>
   ...

      where:

      <issuer_name>
      Specifies the name of your custom issuer. This matches the issuer created in the first step.
    2. If your custom issuer is an internal issuer, the custom issuer is defined at the pod level under the internal attribute as shown below: 
      apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: myctlplane
spec:
  tls:
     ingress:
       enabled: true
     podLevel:
       enabled: true
       internal:
         ca:
           customIssuer: <issuer_name>

      where:

      <issuer_name>
      Specifies the name of your custom issuer. This matches the issuer created in the first step.