customize-certificates-replace-default-router.adoc

Replacing the default ingress certificate

You can replace the default ingress certificate for all applications under the .apps subdomain. After you replace the certificate, all applications, including the web console and CLI, will have encryption provided by specified certificate.

Prerequisites

• You must have a wildcard certificate and its private key, both in the PEM format, for use.

• The certificate must have a subjectAltName extension of *.apps.<clustername>.<domain>.

Procedure

1. Create a ConfigMap that includes the certificate authority used to signed the new certificate:

   $ oc create configmap custom-ca \
        --from-file=ca-bundle.crt=</path/to/example-ca.crt> \//(1)
        -n openshift-config

   1. </path/to/example-ca.crt> is the path to the certificate authority file on your local file system.

2. Update the cluster-wide proxy configuration with the newly created ConfigMap:

   $ oc patch proxy/cluster \
        --type=merge \
        --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'

3. Create a secret that contains the wildcard certificate and key:

   $ oc create secret tls <certificate> \//(1)
        --cert=</path/to/cert.crt> \//(2)
        --key=</path/to/cert.key> \//(3)
        -n openshift-ingress

   1. <certificate> is the name of the secret that will contain the certificate and private key.

   2. </path/to/cert.crt> is the path to the certificate on your local file system.

   3. </path/to/cert.key> is the path to the private key associated with this certificate.

4. Update the Ingress Controller configuration with the newly created secret:

   $ oc patch ingresscontroller.operator default \
        --type=merge -p \
        '{"spec":{"defaultCertificate": {"name": "<certificate>"}}}' \//(1)
        -n openshift-ingress-operator

   1. Replace <certificate> with the name used for the secret in the previous step.