<p>Having difficulty getting a certificate installed in a local development environment that is isolated to WSL2. I've done the exact same steps in macOS and Linux, and have had zero issues.</p>
<p>The steps are the following:</p>
<pre><code># Download and install mkcert
if [[ `uname` = &quot;Darwin&quot; ]] then
    brew install mkcert
    brew install nss
else
    curl -Lo mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-amd64 &amp;&amp; \
        sudo install mkcert /usr/local/bin/
fi

# Installing tls certificate
mkcert -install

# Installing tls certificate
mkcert localhost 127.0.0.1 ::1

# Installing cert-manager locally
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.2.0/cert-manager.yaml

# Add the certificates to secrets
kubectl create secret tls tls-localhost-dev --key=localhost+2-key.pem --cert=localhost+2.pem -n dev

# Create the tls service that will attach to ingress-nginx
kubectl apply -f k8s/dev/tls.yaml
</code></pre>
<pre><code># k8s/dev/tls.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-dev-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: tls-localhost-dev
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: letsencrypt-dev-certificate
  namespace: cert-manager
spec:
  secretName: tls-localhost-dev
  dnsNames:
    - localhost
  issuerRef:
    name: letsencrypt-dev-issuer
    kind: Issuer
</code></pre>
<pre><code># k8s/dev/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-dev&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
  name: ingress-dev
  namespace: dev
spec:
  tls:
    - hosts:
        - localhost
      secretName: tls-localhost-dev
  rules:
    - host: localhost
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: client-cluster-ip-service-dev
                port:
                  number: 3000
</code></pre>
<p>After all of that, you can navigate to <code>localhost</code> and see it has a certificate... on Linux and macOS.</p>
<p>In WSL2, I can't get the certificates working even though there are no errors except for when I <code>describe</code> some of the resources:</p>
<pre><code>$ kubectl describe issuer letsencrypt-dev-issuer -n cert-manager
Name:         letsencrypt-dev-issuer
Namespace:    cert-manager
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
API Version:  cert-manager.io/v1
Kind:         Issuer
Metadata:
  Creation Timestamp:  2021-03-04T01:33:06Z
  Generation:          1
  Managed Fields:
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:status:
        .:
        f:conditions:
    Manager:      controller
    Operation:    Update
    Time:         2021-03-04T01:33:06Z
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:ca:
          .:
          f:secretName:
    Manager:         kubectl-client-side-apply
    Operation:       Update
    Time:            2021-03-04T01:33:06Z
  Resource Version:  800
  Self Link:         /apis/cert-manager.io/v1/namespaces/cert-manager/issuers/letsencrypt-dev-issuer
  UID:               ebad4607-afe7-480a-8107-1c27fa8c2e8d
Spec:
  Ca:
    Secret Name:  tls-localhost-dev
Status:
  Conditions:
    Last Transition Time:  2021-03-04T01:33:06Z
    Message:               Error getting keypair for CA issuer: secret &quot;tls-localhost-dev&quot; not found
    Reason:                ErrGetKeyPair
    Status:                False
    Type:                  Ready
Events:
  Type     Reason         Age                  From          Message
  ----     ------         ----                 ----          -------
  Warning  ErrGetKeyPair  4m30s (x9 over 19m)  cert-manager  Error getting keypair for CA issuer: secret &quot;tls-localhost-dev&quot; not found
  Warning  ErrInitIssuer  4m30s (x9 over 19m)  cert-manager  Error initializing issuer: secret &quot;tls-localhost-dev&quot; not found
</code></pre>
<pre><code>$ kubectl describe certificate tls-localhost-dev -n dev
Name:         tls-localhost-dev
Namespace:    dev
Labels:       app.kubernetes.io/managed-by=skaffold
              skaffold.dev/run-id=a853f8d6-f192-465c-a43f-4369d5c5a636
Annotations:  &lt;none&gt;
API Version:  cert-manager.io/v1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2021-03-04T01:38:18Z
  Generation:          1
  Managed Fields:
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          .:
          f:app.kubernetes.io/managed-by:
          f:skaffold.dev/run-id:
        f:ownerReferences:
          .:
          k:{&quot;uid&quot;:&quot;d596b83b-95eb-46f6-941f-0f6cef0a76d8&quot;}:
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:dnsNames:
        f:issuerRef:
          .:
          f:group:
          f:kind:
          f:name:
        f:secretName:
        f:usages:
      f:status:
        .:
        f:conditions:
        f:nextPrivateKeySecretName:
        f:notAfter:
        f:notBefore:
        f:renewalTime:
    Manager:    controller
    Operation:  Update
    Time:       2021-03-04T01:38:18Z
  Owner References:
    API Version:           networking.k8s.io/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  ingress-dev
    UID:                   d596b83b-95eb-46f6-941f-0f6cef0a76d8
  Resource Version:        1312
  Self Link:               /apis/cert-manager.io/v1/namespaces/dev/certificates/tls-localhost-dev
  UID:                     12d0f503-928b-4aaf-b691-3e6ed6e76e39
Spec:
  Dns Names:
    localhost
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt-dev
  Secret Name:  tls-localhost-dev
  Usages:
    digital signature
    key encipherment
Status:
  Conditions:
    Last Transition Time:        2021-03-04T01:38:18Z
    Message:                     Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
    Reason:                      IncorrectIssuer
    Status:                      True
    Type:                        Issuing
    Last Transition Time:        2021-03-04T01:38:18Z
    Message:                     Existing issued Secret is not up to date for spec: [spec.ipAddresses]
    Reason:                      SecretMismatch
    Status:                      False
    Type:                        Ready
  Next Private Key Secret Name:  tls-localhost-dev-zqwpw
  Not After:                     2023-06-04T00:32:33Z
  Not Before:                    2021-03-04T01:32:33Z
  Renewal Time:                  2023-05-05T00:32:33Z
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Issuing    15m   cert-manager  Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
  Normal  Reused     15m   cert-manager  Reusing private key stored in existing Secret resource &quot;tls-localhost-dev&quot;
  Normal  Requested  15m   cert-manager  Created new CertificateRequest resource &quot;tls-localhost-dev-4xrv9&quot;
</code></pre>
<pre><code>$ kubectl describe secret tls-localhost-dev -n dev
Name:         tls-localhost-dev
Namespace:    dev
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;

Type:  kubernetes.io/tls

Data
====
tls.crt:  1521 bytes
tls.key:  1708 bytes
</code></pre>
<p>Basically says something isn't there that is quite clearly there.</p>
<p>Any suggestions for how to resolve this?</p>

cjones
<p>Ok, got this figured out with some help:</p>
<ul>
<li><a href="https://github.com/Microsoft/WSL/issues/3161#issuecomment-451863149" rel="noreferrer">https://github.com/Microsoft/WSL/issues/3161#issuecomment-451863149</a></li>
<li><a href="https://ddev.readthedocs.io/en/latest/#installation-or-upgrade-windows-wsl2" rel="noreferrer">https://ddev.readthedocs.io/en/latest/#installation-or-upgrade-windows-wsl2</a></li>
<li><a href="https://www.haveiplayedbowie.today/blog/posts/secure-localhost-with-mkcert/" rel="noreferrer">https://www.haveiplayedbowie.today/blog/posts/secure-localhost-with-mkcert/</a></li>
</ul>
<p>This is what worked for my use case. Granted, I didn't test it without installing <code>mkcert</code> into WSL, so that step may not be necessary:</p>
<ol>
<li>Use <code>choco</code> to install <code>mkcert</code>: <code>choco install -y mkcert</code></li>
<li>In Windows, <code>mkcert -install</code></li>
<li>WSL install <code>mkcert</code> (again, not 100% sure this is necessary):
<pre><code>curl -Lo mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-amd64 &amp;&amp;
   sudo install mkcert /usr/local/bin/
</code></pre>
</li>
<li>In WSL, <code>mkcert -install</code> (again, not 100% sure this is necessary)</li>
<li>In Windows:
<pre><code>mkcert localhost 127.0.0.1 ::1
</code></pre>
</li>
<li>This will generate them in your <code>C:\Users\&lt;user&gt;\</code> directory by default</li>
<li>Copy them into WSL, which for my use case is the root of my project</li>
<li>Then for my use case I run:
<pre><code>kubectl create secret tls tls-localhost-dev --key=localhost+2-key.pem --cert=localhost+2.pem -n dev 
</code></pre>
</li>
<li>For my use case, I then run <code>kubectl apply -f k8s/dev/tls.yaml</code> which contains:
<pre><code> apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   name: letsencrypt-dev-issuer
   namespace: cert-manager
 spec:
   ca:
     secretName: tls-localhost-dev
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: letsencrypt-dev-certificate
   namespace: cert-manager
 spec:
   secretName: tls-localhost-dev
   dnsNames:
     - localhost
   issuerRef:
     name: letsencrypt-dev-issuer
     kind: Issuer
</code></pre>
</li>
</ol>
<p>This time after running <code>skaffold dev</code>, and <code>minikube tunnel</code>, my app is running with the TLS certificates like it should be.</p>
