<p>I'm actually trying for a couple of days to setup TLS on my ingress controller.
My Kubernetes cluster is hosted on Azure (AKS).</p>
<p>When I check the Ingress controller logs, I get this :</p>
<blockquote>
<p>W1104 08:49:29.472478       7 backend_ssl.go:45] Error obtaining X.509 certificate: unexpected error creating SSL Cert: no valid PEM formatted block found</p>
</blockquote>
<blockquote>
<p>W1104 08:49:29.472595       7 controller.go:1334] Error getting SSL certificate &quot;myapp-test/myapp-tls&quot;: local SSL certificate myapp-test/myapp-tls was not found. Using default certificate</p>
</blockquote>
<blockquote>
<p>W1104 08:49:29.472611       7 controller.go:1334] Error getting SSL certificate &quot;myapp-test/myapp-tls&quot;: local SSL certificate myapp-test/myapp-tls was not found. Using default certificate</p>
</blockquote>
<p>Here is my myapp-ingress.yml</p>
<pre><code>kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: myapp-test
  namespace: myapp-test
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - test-app.myapp.io
        - test-api.myapp.io
      secretName: myapp-tls
  rules:
    - host: test-app.myapp.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-frontend
                port:
                  number: 80
    - host: test-api.myapp.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-backend-monolith
                port:
                  number: 80
</code></pre>
<p>Here is my Secret.yml</p>
<pre><code>kind: Secret
apiVersion: v1
metadata:
  name: myapp-tls
  namespace: myapp-test
data:
  tls.crt: &gt;-
    BASE64 ENCODED CRT FILE CONTENT
  tls.key: &gt;-
    BASE64 ENCODED KEY FILE CONTENT
type: kubernetes.io/tls
</code></pre>
<p>I actully tried to create ingresses and/or secrets in every namespaces. But Ingress controller still can't find SSL certificate.</p>

<p>based on below error, appears your cert format is not right.</p>
<blockquote>
<p>no valid PEM formatted block found</p>
</blockquote>
<p>Is your original cert in <a href="https://www.ssl.com/guide/pem-der-crt-and-cer-x-509-encodings-and-conversions/" rel="nofollow noreferrer">PEM</a> format? you can decode the cert data in secret and double check, using a command like below (you might need to install <code>jq</code> command, or you can copy the tls.crt data manually and decode it with <code>base64 -d</code> command):</p>
<pre><code>kubectl get secret your-secret-name -n your-namespace -o json | jq '.&quot;data&quot;.&quot;tls.crt&quot;'| sed 's/&quot;//g'| base64 -d -
</code></pre>
<p>below is what I did using a self-signed test cert/key file.</p>
<pre><code> kubectl get secret mytest-ssl-secret -o json
</code></pre>
<blockquote>
<pre><code>{
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;data&quot;: {
        &quot;tls.crt&quot;: &quot;LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVGVENDQXYyZ0F3SUJBZ0lVWG12blRrcGtqMlhiQkx...tLS0K&quot;,
        &quot;tls.key&quot;: &quot;LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQkt...tLS0K&quot;
    },
    &quot;kind&quot;: &quot;Secret&quot;,
    &quot;metadata&quot;: {
        &quot;creationTimestamp&quot;: &quot;2022-11-05T04:22:12Z&quot;,
        &quot;name&quot;: &quot;mytest-ssl-secret&quot;,
        &quot;namespace&quot;: &quot;default&quot;,
        &quot;resourceVersion&quot;: &quot;2024434&quot;,
        &quot;uid&quot;: &quot;d63dce3d-8e5c-478a-be9e-815e59e4bd21&quot;
    },
    &quot;type&quot;: &quot;kubernetes.io/tls&quot;
}
</code></pre>
</blockquote>
<pre><code>kubectl get secret mytest-ssl-secret -o json | jq '.&quot;data&quot;.&quot;tls.crt&quot;'| sed 's/&quot;//g'| base64 -d -
</code></pre>
<blockquote>
<pre><code>-----BEGIN CERTIFICATE-----
MIIEFTCCAv2gAwIBAgIUXmvnTkpkj2XbBLRJo+mpBfp4mvAwDQYJKoZIhvcNAQEL
BQAwgZkxCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdKaWFuZ3N1MQ0wCwYDVQQHDARX
dXhpMRowGAYDVQQKDBFUZXN0IGxpbWl0ZWQgSW5jLjELMAkGA1UECwwCSVQxHDAa
BgNVBAMME3Rlc3QwMDguZXhhbXBsZS5jb20xIjAgBgkqhkiG9w0BCQEWE3Rlc3Qw
...
XO8B+zyFRP1PZnCAkeUdvh6rpMbVHWvfM0QOG4m736b9FK1VmjTG4do=
-----END CERTIFICATE-----
</code></pre>
</blockquote>
