Workaround for "ca md too weak" error in Nginx Ingress Controller

Viewed 2933

I have the Nginx Ingress Controller running on an AWS EKS cluster. I'm trying to enable Mutual SSL. The server certificate I need to use is throwing a SSL error:

Error: exit status 1
2019/01/16 14:37:40 [notice] 3642#3642: ModSecurity-nginx v1.0.0
2019/01/16 14:37:40 [emerg] 3642#3642: SSL_CTX_use_certificate("/etc/ingress-controller/ssl/default-tls.pem") failed (SSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak)
nginx: [emerg] SSL_CTX_use_certificate("/etc/ingress-controller/ssl/default-tls.pem") failed (SSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak)
nginx: configuration file /tmp/nginx-cfg917440593 test failed

When I try to use a self-generated certificate that has sha256 it works perfectly. Are there any workarounds to allow the Ingress controller to accept a weaker certificate? I have tried editing the "ssl-ciphers" annotation, but I am still getting the same error.

This is the Ingress I am using:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
      ssl_ciphers "ALL";
      ssl_password_file /etc/ingress-controller/ssl/password/p.txt;
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    nginx.ingress.kubernetes.io/auth-tls-secret: "default/ca"
    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  name: test-ingress
  namespace: default
spec:
  rules:
  - host: domain.com
    http:
      paths:
      - backend:
          serviceName: test-svc
          servicePort: 80
        path: /
  tls:
  - hosts:
    - domain.com
    secretName: tls

Anyone have any suggestions for this?

0 Answers
Related