<p>We are running an application on k8s cluster on GKE.</p>
<p>We are using an <code>nginx-ingress-controller</code> as external load-balancer Service which is reachable on, let's say, <a href="https://12.345.67.98" rel="nofollow noreferrer">https://12.345.67.98</a> . We are facing an issue that when we directly access the load-balancer on mentioned URL, we get a certificate warning because a self-signed &quot;Kubernetes Ingress Controller Fake Certificate&quot; is used.</p>
<p>We only have Ingress objects that are mapping our domains (e.g. app.our-company.com) to Kubernetes services. The nginx load-balancer is a Kubernetes Service with load-balancer type. For SSL/TLS for our domains <code>cert-manager</code> is used. There is no issue when accessing these domains, only when we directly access the load-balancer on the IP-Address.</p>
<p>Is there a way to somehow replace the certificate on the load-balancer, so it's not using the default fake certificate anymore?</p>

<p>You need to define a secret with your CA signed certificate and the private key. These will have to be base64 encoded in the secret. You will then use this secret in the &quot;tls&quot; section of the ingress manifest.</p>
<p>Ensure that the certificate chain (cert -&gt; intermediate CA -&gt; root CA) is established in the certificate above.</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: nginx-test
spec:
  tls:
    - hosts:
      - foo.bar.com
      # This assumes tls-secret exists and the SSL
      # certificate contains a CN for foo.bar.com
      secretName: tls-secret
  rules:
    - host: foo.bar.com
      http:
        paths:
        - path: /
          backend:
            # This assumes http-svc exists and routes to healthy endpoints
            serviceName: http-svc
            servicePort: 80
</code></pre>
<p><a href="https://kubernetes.github.io/ingress-nginx/examples/tls-termination/" rel="nofollow noreferrer">References</a></p>
