Cert-manager generates three certificates in tls.crt file

corey 0
Viewed 24

I have established kubernetes cluster on one of the private hosting machine with public IP. I installed a few applications there and NGINX as the ingress controller. I would like to make a reachable my services outside of the cluster and be accessible with the specific domain. I installed cert-manager via helm and requested certificate via letsencrypt-prod, (validated domain via http-01 resolver) everything looks perfect (clusterissuer. certificate, certificaterequest, challenge) but from some reason, my TLS secret after BASE64 decoding - contains three certificates in the following order:

-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----

which is incorrect, as far as I know - it should be only two certificates (instead of 3), any ideas what can be wrong with that?

cert-manager ssl-certificate kubernetes kubernetes-helm
1 Answers

There's nothing wrong with it. You are seeing the root certificate, intermediate certificate, and your subscriber certificate.

It's actually normal for certificate authorities to use intermediate certificates.

You can read about it here: https://letsencrypt.org/certificates/

ericfossas0
Related