customize-certificates-api-add-named.adoc

Add an API server named certificate

The default API server certificate is issued by an internal {product-title} cluster CA. You can add additional certificates to the API server to send based on the client’s requested URL, such as when a reverse proxy or load balancer is used.

Prerequisites

• You must have the certificate and key, in the PEM format, for the client’s URL.

• The certificate must be issued for the URL used by the client to reach the API server.

• The certificate must have the subjectAltName extension for the URL.

Warning

Do not provide a named certificate for the internal load balancer (host name api-int.<cluster_name>.<base_domain>). Doing so will leave your cluster in a degraded state.

Procedure

1. Create a secret that contains the certificate and key in the openshift-config namespace.

   $ oc create secret tls <certificate> \//(1)
        --cert=</path/to/cert.crt> \//(2)
        --key=</path/to/cert.key> \//(3)
        -n openshift-config

   1. <certificate> is the name of the secret that will contain the certificate.

   2. </path/to/cert.crt> is the path to the certificate on your local file system.

   3. </path/to/cert.key> is the path to the private key associated with this certificate.

2. Update the API server to reference the created secret.

   $ oc patch apiserver cluster \
        --type=merge -p \
        '{"spec":{"servingCerts": {"namedCertificates":
        [{"names": ["<hostname>"], //(1)
        "servingCertificate": {"name": "<certificate>"}}]}}}' (2)

   1. Replace <hostname> with the hostname that the API server should provide the certificate for.

   2. Replace <certificate> with the name used for the secret in the previous step.

3. Examine the apiserver/cluster object and confirm the secret is now referenced.

   $ oc get apiserver cluster -o yaml
   ...
   spec:
     servingCerts:
       namedCertificates:
       - names:
         - <hostname>
         servingCertificate:
           name: <certificate>
   ...