<p>I have an issue, I want to use an API Gateway client certificate with my ingress config. </p>

<ol>
<li>I've generated the certificate on AWS.</li>
<li><p>I've created the secret of thi certificate: </p>

<pre><code>kubectl create secret generic api --from-file=api-gateway-client-certificate.crt 
--namespace develop
</code></pre></li>
<li><p>I've added the configuration on my ingress file:</p>

<pre><code>annotations:
nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
nginx.ingress.kubernetes.io/auth-tls-secret: "default/api"
nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"`
</code></pre></li>
</ol>

<p>Finally I don't know why I get this error on the ingress-controller:</p>

<blockquote>
  <p>Error obtaining X.509 certificate: Secret "develop/api" contains no keypair or CA certificate</p>
</blockquote>

<p>I use Kubernetes v1.11.1 and nginx-ingress-controller v0.17.1</p>

<p>So you are missing the key and/or the CA for your cert. Did you use a private CA in AWS? The regular certificate manage doesn't give you a key file because it creates the CSR under the hood.</p>

<p>Generally, you'd create your tls secret like this:</p>

<pre><code>kubectl -n kube-system create secret tls my-tls-cert --key=tls.key --cert=tls.crt
</code></pre>

<p>Also, I would append the CA that begins to with <code>-----BEGIN CERTIFICATE-----</code> to the content of <code>api-gateway-client-certificate.crt</code></p>
