I have the Nginx Ingress Controller running on an AWS EKS cluster. I'm trying to enable Mutual SSL. The server certificate I need to use is throwing a SSL error:
Error: exit status 1
2019/01/16 14:37:40 [notice] 3642#3642: ModSecurity-nginx v1.0.0
2019/01/16 14:37:40 [emerg] 3642#3642: SSL_CTX_use_certificate("/etc/ingress-controller/ssl/default-tls.pem") failed (SSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak)
nginx: [emerg] SSL_CTX_use_certificate("/etc/ingress-controller/ssl/default-tls.pem") failed (SSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak)
nginx: configuration file /tmp/nginx-cfg917440593 test failed
When I try to use a self-generated certificate that has sha256 it works perfectly. Are there any workarounds to allow the Ingress controller to accept a weaker certificate? I have tried editing the "ssl-ciphers" annotation, but I am still getting the same error.
This is the Ingress I am using:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/server-snippet: |
ssl_ciphers "ALL";
ssl_password_file /etc/ingress-controller/ssl/password/p.txt;
nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
nginx.ingress.kubernetes.io/auth-tls-secret: "default/ca"
nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
name: test-ingress
namespace: default
spec:
rules:
- host: domain.com
http:
paths:
- backend:
serviceName: test-svc
servicePort: 80
path: /
tls:
- hosts:
- domain.com
secretName: tls
Anyone have any suggestions for this?