<p>I've been following the following tutorial for my AKS setup: <a href="https://github.com/Azure/phippyandfriends" rel="nofollow noreferrer">https://github.com/Azure/phippyandfriends</a>.
But now I'm struggling to get HTTPS working.</p>

<h2>Here's what i did</h2>

<p>I've generated a cert and key via following <a href="https://gist.githubusercontent.com/PowerKiKi/02a90c765d7b79e7f64d/raw/353b5450944434baf2977d7ce3e1286f8494f22d/generate-wildcard-certificate.sh" rel="nofollow noreferrer">shell script</a>
run it in cmd </p>

<p><code>bash generate-wildcard-certificate.sh mydomain.somenumbers.westeurope.aksapp.io</code></p>

<p>That generates 2 files: </p>

<ul>
<li><code>mydomain.somenumbers.westeurope.aksapp.io.crt</code></li>
<li><code>mydomain.somenumbers.westeurope.aksapp.io.key</code></li>
</ul>

<p>Then I created a secret with following command:</p>

<p><code>kubectl create secret tls ingress-crypto-auth --key mydomain.somenumbers.westeurope.aksapp.io.crt --cert  mydomain.somenumbers.westeurope.aksapp.io.crt</code></p>

<p>Added the secret to my <code>ingress.yaml</code> files:</p>

<pre><code>{{ if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  annotations:
    kubernetes.io/ingress.class: addon-http-application-routing
spec:
  tls:
  - hosts:
    - {{ .Values.ingress.basedomain }}
    secretName: ingress-crypto-auth
  rules:
  - host: {{ .Release.Name }}.{{ .Values.ingress.basedomain }}
    http:
      paths:
      - path: /
        backend:
          serviceName: {{ template "fullname" . }}
          servicePort: {{ .Values.service.externalPort }}
{{ end }}
</code></pre>

<p>And it seems that my certificate is loaded, but I get following error:</p>

<blockquote>
  <p>This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.</p>
</blockquote>

<p>Did I do anything wrong? and even more important, how di I get it to work?
I don't care how it's for a temporary project</p>

Kiwi
<p>It is happen because you are using a self-signed certificate.</p>

<blockquote>
  <p>A <strong>self-signed certificate</strong> is a <a href="https://en.wikipedia.org/wiki/Identity_certificate" rel="nofollow noreferrer" title="Identity certificate">certificate</a> that is not signed by a <a href="https://en.wikipedia.org/wiki/Certificate_authority" rel="nofollow noreferrer" title="Certificate authority">certificate authority</a> (CA). These certificates are easy to make and do not cost money. However, they do not provide all of the security properties that certificates signed by a CA aim to provide. For instance, when a website owner uses a self-signed certificate to provide <a href="https://en.wikipedia.org/wiki/HTTPS" rel="nofollow noreferrer" title="HTTPS">HTTPS</a> services, people who visit that website will see a warning in their browser.</p>
</blockquote>

<p>To solve this issue you could buy a valid certificate from a trusted CA, or use Let's Encrypt to generate it.</p>

<h3>Using cert-manager with Let's Encrypt</h3>

<blockquote>
  <p><strong>cert-manager</strong> builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide 'certificates as a service' to developers working within your Kubernetes cluster.</p>
  
  <p><strong>Let's Encrypt</strong> is a non-profit certificate authority run by Internet Security Research Group that provides X.509 certificates for Transport Layer Security encryption at no charge. The certificate is valid for 90 days, during which renewal can take place at any time.
  I'm supossing you already have NGINX ingress installed and working.</p>
</blockquote>

<p><strong>Pre-requisites:</strong>
- <a href="https://kubernetes.github.io/ingress-nginx/deploy/" rel="nofollow noreferrer">NGINX Ingress</a> installed and working
- <a href="https://helm.sh/docs/intro/install/" rel="nofollow noreferrer">HELM 3.0</a> installed and working</p>

<p><strong>cert-manager install</strong></p>

<blockquote>
  <p><strong>Note</strong>: When running on GKE (Google Kubernetes Engine), you may encounter a ‘permission denied’ error when creating some of these resources. This is a nuance of the way GKE handles RBAC and IAM permissions, and as such you should ‘elevate’ your own privileges to that of a ‘cluster-admin’ <strong>before</strong> running the above command. If you have already run the above command, you should run them again after elevating your permissions:</p>
</blockquote>

<p>Follow the <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">official docs</a> to install, or just use HELM 3.0 with the followe command:</p>

<pre class="lang-sh prettyprint-override"><code>$ kubectl create namespace cert-manager
$ helm repo add jetstack https://charts.jetstack.io
$ helm repo update
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.14.1/cert-manager-legacy.crds.yaml
</code></pre>

<p>Create <code>CLusterIssuer</code> for Let's Encrypt: Save the content below in a new file called <code>letsencrypt-production.yaml</code>:</p>

<blockquote>
  <p><strong>Note:</strong> Replace <code>&lt;EMAIL-ADDRESS&gt;</code> with your valid email.</p>
</blockquote>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  labels:
    name: letsencrypt-prod
  name: letsencrypt-prod
spec:
  acme:
    email: &lt;EMAIL-ADDRESS&gt;
    http01: {}
    privateKeySecretRef:
      name: letsencrypt-prod
    server: 'https://acme-v02.api.letsencrypt.org/directory'
</code></pre>

<p>Apply the configuration with:</p>

<p><code>kubectl apply -f letsencrypt-production.yaml</code></p>

<p>Install cert-manager with Let's Encrypt as a default CA:</p>

<pre><code>helm install cert-manager \
--namespace cert-manager --version v0.8.1 jetstack/cert-manager \
--set ingressShim.defaultIssuerName=letsencrypt-prod \
--set ingressShim.defaultIssuerKind=ClusterIssuer
</code></pre>

Verify the installation:

<pre class="lang-sh prettyprint-override"><code>$ kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
</code></pre>

<h3>Using cert-manager</h3>

<p>Apply this annotation in you ingress spec:</p>

<pre><code>cert-manager.io/cluster-issuer: "letsencrypt-prod"
</code></pre>

<p>After apply cert-manager will generate the tls certificate fot the domain configured in <code>Host:</code>.</p>

<pre><code>{{ if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  annotations:
    kubernetes.io/ingress.class: addon-http-application-routing
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - {{ .Values.ingress.basedomain }}
    secretName: ingress-crypto-auth
  rules:
  - host: {{ .Release.Name }}.{{ .Values.ingress.basedomain }}
    http:
      paths:
      - path: /
        backend:
          serviceName: {{ template "fullname" . }}
          servicePort: {{ .Values.service.externalPort }}
{{ end }}
</code></pre>

<p>Please let me know if that helped.</p>
