<p>Can i use any tools from openssl, ssh-keygen and cfssl to create SSH certificates or the TLS certificates for kubernetes components? Is there any difference in using these three tools? Will the keys/certificates generated by these tools be same?</p>

<p>From kubernetes point of view please take a look for docs about using openssl and probably more advanced cfssl <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">here</a>.</p>

<p>Note:</p>

<blockquote>
  <p>All Kubernetes components that use these certificates - kubelet, kube-apiserver, kube-controller-manager - assume the key and certificate to be PEM-encoded.</p>
</blockquote>

<p>I'm not expert in this matter but you can take a look for community posts like:</p>

<ul>
<li><p><a href="https://serverfault.com/questions/9708/what-is-a-pem-file-and-how-does-it-differ-from-other-openssl-generated-key-file">Certificate standards</a> </p></li>
<li><p><a href="https://security.stackexchange.com/questions/29876/what-are-the-differences-between-ssh-generated-keysssh-keygen-and-openssl-keys">differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)</a> </p></li>
<li><p><a href="https://serverfault.com/questions/706336/how-to-get-a-pem-file-from-ssh-key-pair">pem file from ssh key pair</a> </p></li>
<li><p><a href="https://blog.cloudflare.com/introducing-cfssl/" rel="nofollow noreferrer">Introducing CFSSL</a></p></li>
<li><p><a href="https://knowledge.digicert.com/solution/SO26630.html" rel="nofollow noreferrer">certificate convertion</a> </p></li>
<li><p><a href="https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them" rel="nofollow noreferrer">Certificates Convertion</a> </p></li>
</ul>

<p>How is X.509 used in SSH? X.509 certificates are used as a key storage: Instead of keeping SSH keys in a proprietary format, the software keeps the keys in X.509 certificates. When the SSH key exchange is done, the keys are taken from the certificates.</p>

<p>Note - advantages of using X.509 certificates:</p>

<blockquote>
  <p>An <a href="https://en.wikipedia.org/wiki/X.509" rel="nofollow noreferrer">X.509 certificate</a> contains a public key and an identity (a hostname, or an organization, or an individual), and is either signed by a certificate authority or self-signed. When a certificate is signed by a trusted certificate authority, or validated by other means, someone holding that certificate can rely on the public key it contains to establish secure communications with another party, or validate documents digitally signed by the corresponding private key.</p>
</blockquote>

<p>Hope this help:</p>
