kubernetes/website

CN missmatch in Securing nginx example

Open

#33,169 建立於 2022年4月24日

在 GitHub 查看
 (15 留言) (1 反應) (1 負責人)HTML (13,918 fork)batch import
help wantedlifecycle/frozentriage/accepted

倉庫指標

Star
 (4,127 star)
PR 合併指標
 (平均合併 16天 13小時) (30 天內合併 160 個 PR)

描述

In the page - https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#securing-the-service there are two methods provided, to create certificate for setting up nginx with SSL:

  1. Using "make keys KEY=/tmp/nginx.key CERT=/tmp/nginx.crt" inside https://github.com/kubernetes/examples/tree/master/staging/https-nginx/
  2. Using openssl command.

In method 1, the subj used is CN=nginxsvc/O=nginxsvc and in method 2 its /CN=my-nginx/O=my-nginx

Further down the document, to access the site without SSL error following command is provided: kubectl exec curl-deployment-1515033274-1410r -- curl https://my-nginx --cacert /etc/nginx/ssl/tls.crt

This command works fine if the certificate is generated using method 2. However it will give following error if method 1 is used: kubectl exec curl-deployment-948555475-7mnx9 -- curl https://my-nginx --cacert /etc/nginx/ssl/tls.crt curl: (51) SSL: certificate subject name 'nginxsvc' does not match target host name 'my-nginx' command terminated with exit code 51

The subj can be changed in https://github.com/kubernetes/examples/blob/master/staging/https-nginx/Makefile to match my-nginx, however I am not sure if it would impact other examples.

Any suggestions/comments?

貢獻者指南