<p>I used the below command to generate a key locally.</p>

<blockquote>
  <p>openssl genrsa -out testsvc.testns.ing.lb.xyz.io.key.pem 2048</p>
</blockquote>

<p>And the used the below command to generate the CSR(certificate signing request).</p>

<blockquote>
  <p>openssl req -new -sha256 -key testsvc.testns.ing.lb.xyz.io.key.pem
  -subj "/CN=testsvc.testns.ing.lb.xyz.io"</p>
</blockquote>

<p>I generated the certificate chain file using the above CSR file and finally got the below file.</p>

<blockquote>
  <p>testsvc.testns.ing.lb.xyz.io.chain.pem</p>
</blockquote>

<p>I am trying to use them for ingress tls and below is the command for ingress tls.</p>

<blockquote>
  <p>kubectl create secret tls custom-tls-cert --key /path/to/tls.key
  --cert /path/to/tls.crt</p>
</blockquote>

<p>Not sure, How can i use the chain.pem file and key.pem file with the above command. Tried generating crt from the chain.pem and getting error on kubectl create secret.</p>

<pre><code>"error: failed to load key pair tls: failed to find any PEM data in certificate input"
</code></pre>

<p>I would like to create the below secret.</p>

<pre><code>apiVersion: v1
data:
  tls.crt: base64 encoded cert
  tls.key: base64 encoded key
kind: Secret
metadata:
  name: testsecret
  namespace: default
type: Opaque
</code></pre>

<p>Not sure how to generate .crt and .key file with the chain.pem file.</p>

<p>Thanks</p>

<p>First, let's clarify what the key, CSR, and certificate are.  </p>

<p><code>key</code> - locally generated secret file shown/sent to noone (key.pem)<br>
<code>csr</code> - file (request.pem) generated by key.pem, need to be sent to CA (certificate authority). (You can have your own CA, but usually, it is managed by someone else).<br>
<code>cert</code> - file (cert.pem) created by CA based on request.pem and its own CA private key </p>

<p>Now you can use these two files - <code>key.pem</code> and <code>cert.pem</code> - to create a secure connection between your service and a client.  </p>

<p>I suppose you have only created a key and a request. So, you need to go one step further and get a certificate from CA.  </p>

<p>For testing purpose, you can create a new key and a self-signed certificate with one command:  </p>

<blockquote>
  <p>openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days
  365 -nodes -subj
  "/C=US/ST=Florida/L=Miami/O=SomeCompany/OU=ITdepartment/CN=www.mydomain.com"</p>
</blockquote>

<p>(adjust subject to your needs)  </p>

<p>There are different types of keys and certificates, and it's easy to find the way to convert one format into another.  </p>

<p>Using certificate and key in PEM format when creating a Secret should work fine. </p>

<p>Just insert the key and the certificate into that command as follows:  </p>

<pre><code>kubectl create secret tls testsecret --key key.pem --cert cert.pem  
</code></pre>

<p>This command creates a Secret object and encodes <code>key.pem</code> and <code>cert.pem</code> content with base64.   </p>

<p>You can check the content of the created object with the commands:  </p>

<pre><code>kubectl get secret testsecret -o yaml

echo "tls.crt: content" | base64 --decode
</code></pre>

<p>for example:  </p>

<pre><code>echo "LS0t...tLS0tLQo=" | base64 --decode
</code></pre>

<p>Read more about using and generating certificates here:<br>
<a href="https://www.sslshopper.com/article-most-common-openssl-commands.html" rel="noreferrer">https://www.sslshopper.com/article-most-common-openssl-commands.html</a>  </p>

<p><a href="https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl">How to create a self-signed certificate with openssl?</a>  </p>

<p><a href="https://docs.bitnami.com/kubernetes/how-to/secure-kubernetes-services-with-ingress-tls-letsencrypt/" rel="noreferrer">https://docs.bitnami.com/kubernetes/how-to/secure-kubernetes-services-with-ingress-tls-letsencrypt/</a>  </p>

<p><a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">https://kubernetes.io/docs/concepts/configuration/secret/</a> </p>
