How to override Kong Gateway default certificates in Kubernetes

Question

I'm trying to set up an SSL certificate for Kong 2.7 installed in Kubernetes but I am not getting this to work as expected. I tried to follow this guide. Even looking for additional help in discussion .

curl -X POST http://kong-admin:8001/certificates -F "cert=kong.lan.pem" -F "key=kong.lan.key" -F "snis[0]=mydomain.net"

This is my response:

{
  "fields": {
    "cert": "invalid certificate: x509.new: asn1/a_d2i_fp.c:197:error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data",
    "key": "invalid key: pkey.new:load_key: asn1/a_d2i_fp.c:197:error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data"
  },
  "message": "2 schema violations (cert: invalid certificate: x509.new: asn1/a_d2i_fp.c:197:error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data; key: invalid key: pkey.new:load_key: asn1/a_d2i_fp.c:197:error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data)",
  "name": "schema violation",
  "code": 2
}

Kong deployed with helm chart:

$ helm repo add kong https://charts.konghq.com
$ helm repo update

$ helm install kong/kong --generate-name --set ingressController.enabled=true --set admin.enabled=True --set admin.http.enabled=True --set ingress.enabled=True --set proxy.ingress.enabled=True --set admin.type=LoadBalancer --set proxy.type=LoadBalancer

Does any of you know how to make this working or how to add tls.crt and tls.key into Kong Deployment?

score 1 · Accepted Answer · answered Jan 19 '22 at 16:10

You just miss the @ on the curl command to upload files

curl -X POST http://kong-admin:8001/certificates -F "cert=@kong.lan.pem" -F "key=@kong.lan.key" -F "snis[0]=mydomain.net"

curl -X POST http://localhost:8001/certificates -F "cert=kong.lan.pem" -F "key=kong.lan.key" -F "snis[0]=mydomain.net"

will send

POST /certificates HTTP/1.1
Host: localhost:8001
User-Agent: curl/7.68.0
Accept: */*
Content-Length: 363
Content-Type: multipart/form-data; boundary=------------------------d67ae21b533e5746

--------------------------d67ae21b533e5746
Content-Disposition: form-data; name="cert"

kong.lan.pem
--------------------------d67ae21b533e5746
Content-Disposition: form-data; name="key"

kong.lan.key
--------------------------d67ae21b533e5746
Content-Disposition: form-data; name="snis[0]"

mydomain.net
--------------------------d67ae21b533e5746--

echo "toto" >| kong.lan.pem
curl -X POST http://localhost:8001/certificates -F "cert=@kong.lan.pem" -F "key=kong.lan.key" -F "snis[0]=mydomain.net"

will send

POST /certificates HTTP/1.1
Host: localhost:8001
User-Agent: curl/7.68.0
Accept: */*
Content-Length: 421
Content-Type: multipart/form-data; boundary=------------------------973b3467e461334a

--------------------------973b3467e461334a
Content-Disposition: form-data; name="cert"; filename="kong.lan.pem"
Content-Type: application/octet-stream

toto

--------------------------973b3467e461334a
Content-Disposition: form-data; name="key"

kong.lan.key
--------------------------973b3467e461334a
Content-Disposition: form-data; name="snis[0]"

mydomain.net
--------------------------973b3467e461334a--

How to override Kong Gateway default certificates in Kubernetes

1 Answers1