Pushing SocketClutser to Google K8S Engine, the Ingress service not working complaining SSL key is too large

user_12314413 0
Viewed 881

I have created a socketcluster nodejs app. I followed their official docs to deploy the service to Google K8s Engine. However the ingress service is not running up and complains about :

Error:googleapi: Error 400: The SSL key is too large., sslCertificateKeyTooLarge

I tried following certificates:

  1. 4048 Key size certificate from Let'sEncrypt
  2. 2048 Key size using cert created using Open SSL.

Both of them result the the same error.

Do any one know how do I resolve this? And where do I get proper certificate for enabling TLS?

lets-encrypt google-kubernetes-engine node.js google-cloud-platform ssl-certificate
3 Answers

IIRC, only RSA-2048 and ECDSA P256 keys are supported:

openssl genrsa -out PRIVATE_KEY_FILE 2048

openssl ecparam -name prime256v1 -genkey -noout -out PRIVATE_KEY_FILE

user_55297120

I also struggled due to this error on using Letsencrypt certs with 4096bit private key to a GKE ingress - even creating the secret worked fine for [1].

Finally overcame with editing "/etc/letsencrypt/cli.ini"

rsa-key-size = 2048

issued new certificate, keyfile and put those into secret.

[1] https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl

user_8923180

On Cloud Shell, GCP with "openssl" and "gcloud", I tried to create a self-managed SSL certificate first running this command below to create "myCert.crt" and "myKey.key":

openssl req -new -newkey rsa:4096 -x509 -days 365 -nodes -out myCert.crt -keyout myKey.key

Then, ran this command below to create the self-managed SSL certificate "mycert" using "myCert.crt" and "myKey.key":

gcloud compute ssl-certificates create mycert --certificate=myCert.crt --private-key=myKey.key

But I got a similar error to yours:

ERROR: (gcloud.compute.ssl-certificates.create) Could not fetch resource:

  • The SSL key is too large.

So I changed "rsa:4096" to "rsa:2048" then ran the first command again:

                         // "4096" is changed to "2048" 
openssl req -new -newkey rsa:2048 -x509 -days 365 -nodes -out myCert.crt -keyout myKey.key

Then, ran the second command again:

gcloud compute ssl-certificates create mycert --certificate=myCert.crt --private-key=myKey.key

Finally, I could create the self-managed SSL certificate "mycert":

Created [https://www.googleapis.com/compute/v1/projects/myproject-923743/global/sslCertificates/mycert]. NAME: mycert TYPE: SELF_MANAGED CREATION_TIMESTAMP: 2022-01-22T07:22:26.058-08:00 EXPIRE_TIME: 2023-01-22T07:22:08.000-08:00 MANAGED_STATUS:

user_81724390
Related