<p>Quick question, in Rancher is it possible to use lets-encrypt to sign the k8s TLS certs (etcd, kub-api, etc).  I have a compliance requirement to sign my k8s environment with a valid trusted CA chain? </p>

<p>Yes, it is actually one of the <a href="https://rancher.com/docs/rancher/v2.x/en/installation/k8s-install/helm-rancher/#4-choose-your-ssl-configuration" rel="nofollow noreferrer">recommended options</a> for the source of the certificate used for TLS termination at the Rancher server:</p>

<blockquote>
  <p>Let’s Encrypt: The Let’s Encrypt option also uses cert-manager.
  However, in this case, cert-manager is combined with a special Issuer
  for Let’s Encrypt that performs all actions (including request and
  validation) necessary for getting a Let’s Encrypt issued cert.</p>
</blockquote>

<p>In the links below you will find a walkthrough showing how to:</p>

<ul>
<li><a href="https://rancher.com/docs/rancher/v2.x/en/installation/k8s-install/helm-rancher/#5-install-cert-manager" rel="nofollow noreferrer">Install cert-manager</a></li>
<li><a href="https://rancher.com/docs/rancher/v2.x/en/installation/k8s-install/helm-rancher/#6-install-rancher-with-helm-and-your-chosen-certificate-option" rel="nofollow noreferrer">Install Rancher with Helm and Your Chosen Certificate Option</a></li>
</ul>

<blockquote>
  <p>This option uses cert-manager to automatically request and renew Let’s
  Encrypt certificates. This is a free service that provides you with a
  valid certificate as Let’s Encrypt is a trusted CA.</p>
</blockquote>

<p>Please let me know if that helped.</p>
