<p>I am having a problem with my TLS. I have my TLS secret created:</p>
<pre><code>kubectl create secret tls ingress-tls  --key certificate.key  --cert certificate.crt
</code></pre>
<p>And I use it in my ingress:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: &quot;beta&quot;
spec:
  tls:
  - hosts:
    - '*.host.com'
    - 'beta.host.com'
    secretName: ingress-tls
  backend:
    serviceName: nginx
    servicePort: 443
</code></pre>
<p>The ingress is created perfectly, I access through a browser and no problem, the problem comes when I do a curl or using the program postman, I get certificate error.</p>
<blockquote>
<p>curl: (60) SSL certificate problem: unable to get local issuer
certificate More details here: <a href="https://curl.haxx.se/docs/sslcerts.html" rel="nofollow noreferrer">https://curl.haxx.se/docs/sslcerts.html</a></p>
<p>curl failed to verify the legitimacy of the server and therefore could
not establish a secure connection to it. To learn more about this
situation and how to fix it, please visit the web page mentioned
above.</p>
</blockquote>
<p>I'm using the GCE driver, it's the default GKE from google cloud.</p>
<p>I've been reading how to add the ca key, but this error is not fixed.</p>
<p>I did the following:</p>
<pre><code>kubectl create secret generic ca --from-file certificate.ca.crt
</code></pre>
<p>And I added the following annotation to the ingress:</p>
<pre><code>ingress.kubernetes.io/auth-tls-secret: ca
</code></pre>
<p>But is not working.</p>
<p>Does anyone know how to fix the CA certificate? The certificate is purchased on the DonDominio website and it's a Wildcard.</p>

<p>The problem was basically that I was using the .crt instead of the .pem when I generated the TLS secret. By changing the secret I got curl to detect it as a valid certificate.</p>

<p>New command:</p>

<pre><code>kubectl create secret tls ingress-tls --key certificate.key --cert certificate.pem 
</code></pre>

<p>Thanks to @Michael-sqlbot!</p>
