我们如何在 GCP 实例中生成自我管理证书？

Question

i am testing with Open SSL in GCP instance. and how can generate Self Managed Certificates in GCP instance.

Answer 1

You can make certificate and domain status active, it can take up to 30 mins for your load balancer to begin using your self-managed SSL certificate

To test this you can run the following OpenSSL command, replacing

DOMAIN ----------------------- with-----------------------DNS name
IP_ADDRESS-------------------with-----------------------IP address of your load balancer.

echo | openssl s_client -showcerts -servername DOMAIN -connect IP_ADDRESS:443 -verify 99 -verify_return_error

This command outputs the certificates that the load balancer presents to the client. Along with other detailed information, the output should include the certificate chain. Verify return code: 0 (ok).

For more information you can refer to this link .

Answer 2

There are so many ways we can issue certificates, let's focus on K8S cluster running on Google (GKE) using a custom resource called ManagedCertificate and ingress rules.

• You must own the domain name and name must be no longer than 63 characters.

• Create a reserved (static) external IP address using the following command, or use google console.

  gcloud compute addresses create gke-static-ip --global

Create Managed Certificate

---
apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: gke-certificate
spec:
  domains:
    - DOMAIN

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: gke-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: gke-static-ip
    networking.gke.io/managed-certificates: gke-certificate
spec:
  backend:
    serviceName: hello-world-service
    servicePort: 80

in my case i use the cloud endpoints as domain name