Skip to main content

Integrate cert-manager with Private CA

DigiCert​​®​​ Issuer for cert-manager lets you use DigiCert Private CA as an external issuer for cert-manager in your Kubernetes environment. This integration enables cert-manager to obtain private certificates from DigiCert Private CA instead of its built-in issuers.

You can continue using cert-manager to request and manage certificates while your Private CA handles issuance through your existing CA and certificate templates. This keeps Kubernetes certificate issuance aligned with the private PKI you already manage in DigiCert Private CA.

DigiCert Issuer runs a controller in your Kubernetes cluster. The controller processes certificate requests from cert-manager and sends them to DigiCert Private CA for issuance.

Choose an issuer type

DigiCert Issuer provides two issuer resources:

Issuer

Use

DigiCertIssuer

Issue certificates within a single Kubernetes namespace. The issuer reads its credentials and trust information from Secrets in the same namespace.

DigiCertClusterIssuer

Issue certificates across Kubernetes namespaces. The issuer reads its credentials and trust information from the configured cluster-resource namespace. The default namespace is cert-manager.

Before you begin

Make sure you have:

  • A Kubernetes cluster with cert-manager installed.

  • Access to the DigiCert Issuer source repository and the tools required to build and deploy the controller.

  • The DigiCert Private CA service URL.

  • The issuing CA ID.

  • Your DigiCert account ID. Required only for DigiCert-hosted environments.

  • The certificate template ID.

  • An API key or bearer token authorized to use the configured CA, account, and certificate template.

  • The PEM trust bundle required to verify the DigiCert Private CA service over HTTPS. Treat this as required for production.

DigiCert Issuer supports API-key and bearer-token authentication.

Set up the integration

To integrate cert-manager with DigiCert Private CA:

  1. Build and deploy DigiCert Issuer in your Kubernetes cluster.

  2. Create Kubernetes Secrets for the DigiCert credentials and TLS trust bundle.

  3. Create a DigiCertIssuer or DigiCertClusterIssuer.

  4. Configure the issuer with the DigiCert Private CA service, issuing CA, account, certificate template, and Secrets.

  5. Verify that the issuer reaches the Ready state.

  6. Create a cert-manager Certificate resource that references the issuer.

  7. Apply the Certificate resource to request a certificate.

  8. Verify that cert-manager receives the issued certificate and stores it in the configured Kubernetes Secret.

Use the certificate ID or serial number recorded by DigiCert Issuer to identify the corresponding certificate in DigiCert Private CA or your Kubernetes automation.

For build and deployment instructions, Kubernetes manifests, configuration examples, and troubleshooting, see DigiCert Issuer for cert-manager on GitHub.

注記

Revocation is not managed through DigiCert Issuer. Revoke certificates separately in DigiCert Private CA. Deleting a cert-manager Certificate resource does not revoke the certificate.

このセクションの内容: