<p>I can't get my Ingress to use my TLS cert. I have created a self signed TLS cert using openssl for hostname myapp.com and added myapp.com to /etc/hosts.</p>
<p><code>openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365</code></p>
<p>I have verified the Ingress is using the TLS cert</p>
<pre><code>$ kubectl describe ingress myapp-ingress
Name:             myapp-ingress
Labels:           app=myapp
                  name=myapp-ingress
Namespace:        default
Address:          $PUBLIC_IP
Ingress Class:    nginx-ingress-class
Default backend:  &lt;default&gt;
TLS:
  nginx-ingress-tls terminates myapp.com
Rules:
  Host        Path  Backends
  ----        ----  --------
  myapp.com
              /   myapp-service:8080 (10.244.0.14:80)
Annotations:  &lt;none&gt;
Events:
  Type    Reason  Age                 From                      Message
  ----    ------  ----                ----                      -------
  Normal  Sync    19m (x11 over 21h)  nginx-ingress-controller  Scheduled for sync
</code></pre>
<p>however, when I curl myapp.com, I get an error message informing me no subject name matches target host 'myapp.com'.</p>
<pre><code>$ curl -I https://myapp.com
curl: (60) SSL: no alternative certificate subject name matches target host name 'myapp.com'
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
</code></pre>
<p>I made sure to give openssl myapp.com as the FQDN. I'm not sure why it isn't working. Any help is appreciated.</p>
<p>Edit:</p>
<p>I'm looking at the logs of the ingress controller. I see the following error messages</p>
<pre><code>$ kubectl logs -n nginx-ingress ingress-nginx-controller-7c45d9ff9f-2hcd7 | grep cert
I0618 20:43:32.096653       7 main.go:104] &quot;SSL fake certificate created&quot; file=&quot;/etc/ingress-controller/ssl/default-fake-certificate.pem&quot;
I0618 20:43:32.116162       7 ssl.go:531] &quot;loading tls certificate&quot; path=&quot;/usr/local/certificates/cert&quot; key=&quot;/usr/local/certificates/key&quot;
W0618 20:43:33.246716       7 backend_ssl.go:45] Error obtaining X.509 certificate: unexpected error creating SSL Cert: certificate and private key does not have a matching public key: tls: failed to parse private key
I0618 20:43:33.340807       7 nginx.go:319] &quot;Starting validation webhook&quot; address=&quot;:8443&quot; certPath=&quot;/usr/local/certificates/cert&quot; keyPath=&quot;/usr/local/certificates/key&quot;
W0618 20:43:33.342061       7 controller.go:1334] Error getting SSL certificate &quot;default/nginx-ingress-tls&quot;: local SSL certificate default/nginx-ingress-tls was not found. Using default certificate
W0618 20:43:37.149824       7 controller.go:1334] Error getting SSL certificate &quot;default/nginx-ingress-tls&quot;: local SSL certificate default/nginx-ingress-tls was not found. Using default certificate
W0618 20:43:41.152972       7 controller.go:1334] Error getting SSL certificate &quot;default/nginx-ingress-tls&quot;: local SSL certificate default/nginx-ingress-tls was not found. Using default certificate
</code></pre>

Timothy Pulliam
<p>When you are using a cert that is not signed by trusted certificates in the installed CA certificate store, you will get the error message:</p>
<pre><code>failed to verify the legitimacy of the server and therefore could not establish a secure connection to it
</code></pre>
<p>As a workaround, you can disable the strict certificate checking it with the following command:</p>
<pre><code>curl -k https://myapp.com
</code></pre>
<p>You can find more details about it in this <a href="https://curl.haxx.se/docs/sslcerts.html" rel="nofollow noreferrer">link</a>.</p>
