Use cert-manager with Let's Encrypt® Certificates Tutorial: Automatic Browser-Trusted HTTPS

Let's Encrypt® provides free browser-accepted TLS Certificates and an API to automate against. Luckily there's the amazing cert-manager tool, which we can use to do all the communication with Let's Encrypt's ACME API based on Kubernetes Resources. Learn how to fully automatically obtain and renew TLS certificates that will be shown as "Secure" in your favorite browser.

Let's Encrypt® is a trademark of the Internet Security Research Group. All rights reserved

[kubucation]

It seems the microphone gain was a little high this time, sorry for the slightly worse audio quality today.

[dipeti]

I cannot express how grateful I am for you having shared this for free on YT. Would love to buy you a coffee or a bratwurst for your efforts.

[takkerutube]

Excellent video on automating certificates in K8's. Probably the best out there. Thank you very much for taking time to do this video. Keep up your amazing work!

[TheEbbemonster]

Great work! Even in 2022 it is a great video. Sure I had to update some versions, and some of the ACME stuff has changes, but I got it all up and running :)

[rishabhsingh]

Not only the topic was covered well, and gave a clarity on how different resources interact when working with cert-manager,
but, there was so much learning in the way you went about the demo.

Use of aliases, shell configuration, working with the vim, using various commands more efficiently, etc was the highlight for me. Really shows you have given some good amount of time and thought in developing these skills.

Do you have any such video where you explained about the configurations you have done with your shell?

[newshatavakoli]

This video was right to the point, just right amount of explanation, not too much, not too little. Thank you so much.

[prashantantil]

I have also done the similar setup but I cannot find the 'RenewalScheduled' when described the certificate resource.

[sureshkachwa]

In my case, I have cert-manager, ingress controller, ing svc, a cluster issuer for k8s cluster deployed and no certifcate.yaml still certificate is been created for all the NS's and not sure for which domain, does certificate get's created for the domain you map an A record with your LB public ip?

[VIPULKAM]

Are the steps same for AWS eks as well?

[the_superb_owl]

This is the most complete tutorial I've found so far, but I'm still unable to follow. I'm not sure how to get the setup you have at the beginning and things like the ingress yaml are never fully displayed. I checked earlier videos and couldn't get the same setup you have here. Is there a text version of this tutorial anywhere?

[VijayKumarP-wvvw]

DO we need to create secrets or it will create automatically

[petersonfs]

Its possible to create a certificate with dynamic host? My service expose and IP address for the customers configuring their domains point to our services. At the mean time i want to provide a certificate for each domain using our service, to increase security. At the momento we have 5k domains point to our services. Could you help me? Thanks!

[abhijitdasgupta]

Hi, Are you having any video of configuration between Cert-Manager and Vault.

[amitkadosh]

@kubucation, very good explaination !!
do you have the console output or the "history" of the commands you typed ?
thank you !

[puneetsaini]

Hi kubucation
Is it possible to use third party service as an issuer.
For example there is a service called abc, make a rest api call to it gives you the certificate. Is it possible to setup the same using this service. If yes can you please share example yaml files for it

[BernardoGarcia]

Great video @kubucation. I have a doubt. Finally are you using the youtube-lets-encrypt-tls or the secrets tls.key and tls.crt created before in the previous videos. Or do I need perform both steps?

This means, create my own tls.key and tls.crt and store them in a secret, and after, when you are creating the certificate resource, in the "issuerRef" parameter, that secret is other secret which will be created and inside it will be the key.tls and the certificate that provide letsencrypt?

The https functionality only do you get it when remove staging and enter production?

[paweoczady]

Great tutorial! Many thanks for that stuff :)

[ducleex]

Great tutorial, but could you please explain me how to point domain to the cluster?

[ovidiuviper]

Hi, how would you fix the following issue in the http-01 challenge? Waiting for http-01 challenge propagation: presented key () did not match expected

[sharatbhaskar]

can we use letsencrypt certificate for production app?