Skip to main content

Use cert-manager and DigiCert ACME service with Kubernetes

This process works in cert-manager 1.1 and later. It assumes you understand how to use the command line and have access to install software your environment.

Create a certificate profile for ACME enrollment

  1. In DigiCert​​®​​ Trust Lifecycle Manager, create a certificate profile for third-party ACME integration.

  2. Copy and save the ACME credentials for the certificate profile (URL, HMAC key, and key ID) in a secure location. If you lose these values, you will need to reinstall and reconfigure cert-manager.

Example:

  • KID: jvJrlqcDpK1cO3IiinRFJ_9L1tiaA6lmUGFmTTg32RM

  • HMAC key: MWJiMjQ5MDQ5YWUzOTFiN2JlOWNmODBmNDY2NWNhM2U2MTgyYzI2ZDMxZDNhNmJmNzliZTZlNzE5MzIxODk1Yg

Configure cert-manager

  1. Open a terminal window and log in to your environment. Install cert-manager as shown below.

    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.yaml
    kubectl get namespaces
    
  2. Create a namespace for cert-manager.

    kubectl create namespace <namespace>  

    Example:

    kubectl create namespace certmanagernew
  3. Create a secret in cert-manager for the external account binding (EAB-HMAC). Use the HMAC key you saved in Create an ACME directory URL above in the eab_hmac field below.

    kubectl create secret generic <eab_secret_name> --from-literal secret=<eab_hmac> -n <namespace>

    Example:

    kubectl create secret generic testcmanagereab --from-literal secret=MWJiMjQ5MDQ5YWUzOTFiN2JlOWNmODBmNDY2NWNhM2U2MTgyYzI2ZDMxZDNhNmJmNzliZTZlNzE5MzIxODk1Yg -n certmanagernew
  4. Create a YAML (test-cmanager-acme.yaml) configuration file specifying the values for the parameters to add an issuer in cert-manager.

    Nota

    The server URL in the below example will work for local TLM deployments. If you deployed TLM from the cloud, provide the automation URL you received when you set up your ACME profile.

    Example: Update the text below with your namespace, email, server, keyID, and keySecretRef name. Save as test-cmanager-acme.yaml.

    1apiVersion: cert-manager.io/v1
    2kind: Issuer
    3metadata:
    4  name: testcmanager-issuer
    5  namespace: certmanagernew
    6spec:
    7  acme:
    8    email: t2@digicert.com
    9    #New enrollments only
    10    server: http://enterprise.dcone.svc.cluster.local/mpki/api/v1/acme/v2/directory
    11    skipTLSVerify: true
    12    externalAccountBinding:
    13      keyID: jvJrlqcDpK1cO3IiinRFJ_9L1tiaA6lmUGFmTTg32RM
    14      keySecretRef:
    15        name: testcmanagereab
    16        key: secret
    17      keyAlgorithm: HS256
    18    privateKeySecretRef:
    19      name: testcmanageraccountkey
    20    solvers:
    21    # An empty 'selector' means that this solver matches all domains
    22    - selector: {}
    23      http01:
    24        ingress:
    25          class: nginx
  5. Run the command below and wait for the account to be created.

    kubectl apply -f test-cmanager-acme.yaml
  6. Run kubectl describe to verify the ACME account has been registered to the DigiCert ACME server. Example:

    kubectl describe issuer -n certmanagernew
  7. Create a YAML (test-cmanager-acme-certificate.yaml) configuration file specifying the values for the parameters to add Issuer in cert-manager.

    Example: Update the text below with your namespace, common name, and DNS names.

    1apiVersion: cert-manager.io/v1
    2kind: Certificate
    3metadata:
    4  name: testcmanager-certificate-test.winthecustomer.com
    5  namespace: certmanagernew
    6spec:
    7  secretName: testcmanagercertificate
    8  issuerRef:
    9    name: testcmanager-issuer
    10  commonName: winthecustomer.com
    11  dnsNames:
    12  - winthecustomer.com
  8. Run kubectl apply test-cmanager-acme-certificate.yaml to obtain the certificate.

    kubectl apply -f test-cmanager-acme-certificate.yaml 

Additional commands

Check certificate status:

kubectl describe certificate  -n certmanagernew    

Fetch certificate from issuer:

kubectl describe certificaterequest -n certmanagernew

Request new certificate with same credentials:

kubectl delete -f test-cmanager-acme-certificate.yaml 
kubectl apply -f test-cmanager-acme-certificate.yaml

Request new certificate with different credentials:

  1. Run these commands:

    kubectl delete -f test-cmanager-acme.yaml
    kubectl delete -f test-cmanager-acme-certificate.yaml 
  2. Delete the EAB secret you created earlier.

  3. Using your updated KID and HMAC key values, follow the above process starting with step 3.

Uninstall commands

To uninstall cert-manager:

kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.yaml 

Removes all cert-manager resources. Required only in case of reinstallation.

To uninstall namespace:

kubectl delete ns certmanagernew