<p>Need help on how to configure TLS/SSL on k8s cluster for internal pod to pod communication over https. Able to curl http://servicename:port over http but for https i am ending up with NSS error on client pod.</p>
<p>I generated a self signed cert with CN=*.svc.cluster.local (As all the services in k8s end with this) and i am stuck on how to configure it on k8s.</p>
<p>Note: i exposed the main svc on 8443 port and i am doing this in my local docker desktop setup on windows machine.</p>
<ol>
<li>No Ingress --&gt; Because communication happens within the cluster itself.</li>
<li>Without any CRD(custom resource definition) cert-manager</li>
</ol>

<p>You can store your self-signed certificate inside the secret of Kubernetes and mount it to the volume of the pod.</p>
<p>If you don't want to use the CRD or cert-manager you can use the native Kubernetes API to generate the Certificate which will be trusted by all the pods by default.</p>
<p><a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/</a></p>
<p>managing the self singed certificate across all pods and service might be hard I would suggest using the service mesh. Service mesh encrypts the network traffic using the <code>mTLS</code>.</p>
<p><a href="https://linkerd.io/2.10/features/automatic-mtls/#:%7E:text=By%20default%2C%20Linkerd%20automatically%20enables,TLS%20connections%20between%20Linkerd%20proxies" rel="nofollow noreferrer">https://linkerd.io/2.10/features/automatic-mtls/#:~:text=By%20default%2C%20Linkerd%20automatically%20enables,TLS%20connections%20between%20Linkerd%20proxies</a>.</p>
<p>Mutual <strong>TLS</strong> between service to service communication managed by the Side car containers in case of service mesh.</p>
<p><a href="https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/</a></p>
<p>in this case, No ingress required and no <strong>cert-manager</strong> required.</p>
