<p>I am having the following issue.
I am new to GCP/Cloud, I have created a cluster in GKE and deployed our application there, installed nginx as a POD in the cluster, our company has a authorized SSL certificate which i have uploaded in Certificates in GCP.</p>
<p>In the DNS Service, i have created an A record which matched the IP of Ingress.
When i call the URL in the browser, it still shows that the website is still unsecure with message &quot;Kubernetes Ingress controller fake certificate&quot;.</p>
<p>I used the following guide <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates/self-managed-certs#console_1" rel="noreferrer">https://cloud.google.com/load-balancing/docs/ssl-certificates/self-managed-certs#console_1</a></p>
<p>however i am not able to execute step 3 &quot;Associate an SSL certificate with a target proxy&quot;, because it asks &quot;URL Maps&quot; and i am not able to find it in the GCP Console.</p>
<p>Has anybody gone through the same issue like me or if anybody helps me out, it would be great.</p>
<p>Thanks and regards,</p>

<p>I was able to fix this problem by adding an extra argument to the ingress-nginx-controller deployment.</p>
<p>For context: my TLS secret was at the default namespace and was named <code>letsencrypt-secret-prod</code>, so I wanted to add this as the default SSL certificate for the Nginx controller.</p>
<p>My first solution was to edit the <code>deployment.yaml</code> of the Nginx controller and add at the end of the <code>containers[0].args</code> list the following line:</p>
<pre class="lang-yaml prettyprint-override"><code>- '--default-ssl-certificate=default/letsencrypt-secret-prod'
</code></pre>
<p>Which made that section of the yaml look like this:</p>
<pre class="lang-yaml prettyprint-override"><code>      containers:
        - name: controller
          image: &gt;-
            k8s.gcr.io/ingress-nginx/controller:v1.2.0-beta.0@sha256:92115f5062568ebbcd450cd2cf9bffdef8df9fc61e7d5868ba8a7c9d773e0961
          args:
            - /nginx-ingress-controller
            - '--publish-service=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--election-id=ingress-controller-leader'
            - '--controller-class=k8s.io/ingress-nginx'
            - '--ingress-class=nginx'
            - '--configmap=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--validating-webhook=:8443'
            - '--validating-webhook-certificate=/usr/local/certificates/cert'
            - '--validating-webhook-key=/usr/local/certificates/key'
            - '--default-ssl-certificate=default/letsencrypt-secret-prod'
</code></pre>
<p>But I was using the helm chart: <code>ingress-nginx/ingress-nginx</code>, so I wanted this config to be in the <code>values.yaml</code> file of that chart so that I could upgrade it later if necessary.</p>
<p>So reading the values file I replaced the attribute: <code>controller.extraArgs</code>, which looked like this:</p>
<pre class="lang-yaml prettyprint-override"><code>  extraArgs: {}
</code></pre>
<p>For this:</p>
<pre class="lang-yaml prettyprint-override"><code>  extraArgs:
    default-ssl-certificate: default/letsencrypt-secret-prod
</code></pre>
<p>This restarted the deployment with the argument in the correct place.</p>
<p>Now I can use ingresses without specifying the <code>tls.secretName</code> for each of them, which is awesome.</p>
<p>Here's an example ingress that is working for me with HTTPS:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: some-ingress-name
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTP&quot;
spec:
  rules:
  - http:
      paths:
      - path: /some-prefix
        pathType: Prefix
        backend:
          service:
            name: some-service-name
            port:
              number: 80
</code></pre>
