Hi,
The CN in the certificate has to match the host name from the https query.
Can you check if that is the case?
Is possible that the certificate was issued with the public host name.
Hope this helps!
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi everyone. I was going through this microsoft documentation to implement TLS in nginx ingress controller for my application running in Azure Kubernetes Service. My ingress resource is below
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
namespace: my-ingress-ns
spec:
ingressClassName: nginx
tls:
- hosts:
- my_azure_private_dns
secretName: ingress-tls
rules:
- host: my_azure_private_dns
http:
paths:
- path: /data/
pathType: Prefix
backend:
service:
name: svc1
port:
number: 80
- path: /programs/
pathType: Prefix
backend:
service:
name: svc1
port:
number: 80
the ingress resource is deployed in the same namespace as my app pod and service. the TLS Secret (ingress-tls) is also deployed to the same namespace as the ingress resource, app and service. Since my company is the CA, i ran the update-ca-certificates to trust the root certificates when the k8s deployment is created using a bash script which acts as the entry point to my dockerfile
start.sh
#!/bin/sh
update-ca-certificates
dotnet my.App.dll
dockerfile
...
CMD ["./start.sh"]
after my deployemnt is created and i exec into the pod, i can see that the root certificates has been installed in /etc/ssl/certs
The problem is when i try to access my app thro my azure private dns i have this error: NET::ERR_CERT_AUTHORITY_INVALID
and when i run curl: curl https://my_azure_private_dns/data -kv
it shows me this error: * SSL certificate verify result: unable to get local issuer certificate (20)
Please can someone tell me where i am wrong? Thank you
Hi,
The CN in the certificate has to match the host name from the https query.
Can you check if that is the case?
Is possible that the certificate was issued with the public host name.
Hope this helps!