Certificates on Support Tools

Enterprise PKI Management with cert-manager: Automated Certificate Lifecycle in Production Kubernetes

Wed, 24 Jun 2026 00:00:00 -0500

Managing digital certificates at scale across distributed Kubernetes environments presents significant operational challenges for enterprise organizations. cert-manager transforms certificate lifecycle management from a manual, error-prone process into an automated, policy-driven system that ensures security compliance and operational efficiency. This comprehensive guide demonstrates enterprise-grade PKI implementation patterns, advanced automation strategies, and production-ready security practices for mission-critical infrastructure.

RKE2 the Hard Way: Part 1 – Introduction and Prerequisites for Building a Kubernetes Cluster

Tue, 01 Apr 2025 00:00:00 +0000

Introduction

Welcome to the “RKE2 the Hard Way” training series! In this series, we’ll embark on a journey to build a Kubernetes cluster from scratch—mimicking the robust features of Rancher Kubernetes Engine 2 (RKE2)—without relying on any distribution-specific tools or installers.

It’s called the “hard way” because we’ll manually configure and set up each component of the Kubernetes cluster. This approach is designed to provide a deep understanding of how Kubernetes works under the hood and to highlight the automation and simplification RKE2 provides.

RKE2 the Hard Way: Part 2 – Certificate Authority and TLS Certificates

Tue, 01 Apr 2025 00:00:00 +0000

Part 2 – Certificate Authority and TLS Certificates

In this part of the “RKE2 the Hard Way” training series, we will set up our own Certificate Authority (CA) and generate the necessary TLS certificates for securing our Kubernetes cluster. Kubernetes components communicate over TLS, and properly configured certificates are crucial for cluster security.

We’ll use cfssl, Cloudflare’s TLS toolkit, to create our CA and generate certificates.

✅ Assumption: All commands in this guide are run from node01, which is a Linux box.

Installing cert-manager on Kubernetes

Sat, 18 May 2024 19:26:00 -0500

Simplify certificate management on Kubernetes by installing cert-manager. This guide covers installation, configuration, and usage, helping you automate certificate issuance and management.

Add a CA Certificate to Ubuntu: update-ca-certificates

Thu, 12 Oct 2023 23:18:00 -0500

To trust a private or self-signed certificate authority on Ubuntu, put the CA certificate in /usr/local/share/ca-certificates/ with a .crt extension and run sudo update-ca-certificates. That rebuilds /etc/ssl/certs/ca-certificates.crt, the bundle that curl, wget, git, apt, OpenSSL and most other tools on Ubuntu read. The procedure is identical on Ubuntu 22.04, 24.04 and 26.04. This guide covers getting the right certificate, the expected output, the three mistakes that make it silently do nothing, and the applications that ignore the system store.

How to become a local CA, and sign your own SSL certificates

Tue, 19 Nov 2019 20:17:00 +0000

Sometimes when you experiment with some apps and VMs (like hosting gitlab on a local server or running a Rancher lab cluster) you might want to setup SSL for the app to work, to mimic the live setup and to make the browser happy. In order to do that, you need a SSL certificate.

You can buy one for your domain from a trusted CA, but if you’re working on a local network, that might not be possible. The other solution is… becoming CA yourself and issuing and signing the certificate yourself!

It’s pretty easy, you need a linux box with openssl installed, then follow these instructions: