<p>I did create a Master Cluster with the following command:</p>

<p><code>kubeadm init --pod-network-cidr $CALICO_NETWORK</code></p>

<p>Now it is listening in the internal IP 10.3.8.23:6443, which is ok because I want that the master uses the internal IP to communicate with Nodes.</p>

<p>Now I want to access the cluster using the public IP and I get the following error:</p>

<p><strong>http: proxy error: x509: certificate is valid for 10.96.0.1, 10.3.8.23, not for 18.230.*.*.</strong></p>

<p>How can I generate an additional certificate for the publicIP?</p>

<p>I need to use the public IP in order to access the dashboard using the browser.</p>

<p>I install it using: <a href="https://github.com/kubernetes/dashboard" rel="nofollow noreferrer">https://github.com/kubernetes/dashboard</a></p>

<p>If you don't want to recreate your cluster you can also do what's described here: <a href="https://stackoverflow.com/questions/46360361/invalid-x509-certificate-for-kubernetes-master">Invalid x509 certificate for kubernetes master</a></p>

<p>For K8s 1.7 and earlier:</p>

<pre><code>rm /etc/kubernetes/pki/apiserver.*
kubeadm alpha phase certs selfsign \
  --apiserver-advertise-address=0.0.0.0 \
  --cert-altnames=10.96.0.1 \
  --cert-altnames=10.3.8.23 \
  --cert-altnames=18.230.x.x  # &lt;== Public IP
docker rm `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet
</code></pre>

<p>For K8s 1.8 an newer:</p>

<pre><code>rm /etc/kubernetes/pki/apiserver.*
kubeadm alpha phase certs all \
  --apiserver-advertise-address=0.0.0.0 \
  --apiserver-cert-extra-sans=10.96.0.1,10.3.8.23,18.230.x.x # &lt;== Public IP
docker rm -f `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet
</code></pre>

<p>And you can also add DNS name with the <code>--apiserver-cert-extra-sans</code> option.</p>
