<p>I have bought a WildCard ssl certificate from Azure App Service Certificate. I also have an AKS Cluster. I want to put it in the secret and use in ingress. After purchase it stored secret file in Azure Key Vault. I downloaded it and then imported to create Azure Key Vault Certificate. Then with akv2k8s I created a secret file in my AKS and used it in ingress. After my application threw 'err_cert_authority_invalid' error.
Do I do anything wrong ??
There is not so many documentation on ssl and ingress. In many articles, they use 'Lets Encrypt' or 'Cert Manager'.</p>
<p><a href="https://akv2k8s.io/" rel="nofollow noreferrer">https://akv2k8s.io/</a></p>
<p><a href="https://i.stack.imgur.com/JEQgt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JEQgt.png" alt="enter image description here" /></a></p>

Ruben Aleksanyan
<p>•   It can be due to the misinterpretation that the certificate is issued by the staging environment or vice versa. Thus, for that purpose, I would suggest you to please check the <strong>‘stable/wordpress’</strong> helm chart with the ingress annotation <strong>'certmanager.k8s.io/cluster-issuer': 'letsencrypt-staging'</strong>. This will result in being issued a certificate from the fake issuer. Thus, even if your certificate is ingressed in your AKS as a secret, it will be shown as being issued from a fake issuer since the chain of certificate hash validation is broken in between. Please find below the curl for that purpose: -</p>
<pre><code>   ‘ # curl -vkI https://blog.my-domain.com/
     ...
     * Server certificate:
     *  subject: CN=blog.my-domain.com
     *  start date: May 13 08:51:13 2019 GMT
     *  expire date: Aug 11 08:51:13 2019 GMT
     *  issuer: CN=Fake LE Intermediate X1
     ... ‘
</code></pre>
<p>Then, list the ingresses as follows: -</p>
<pre><code>  ‘ # kubectl get ing
    NAME             HOSTS                              ADDRESS          PORTS     AGE
    blog-wordpress   blog.my-domain.com   35.200.214.186   80, 443   8m48s ’
</code></pre>
<p>and the certificates too: -</p>
<pre><code>  ‘ # kubectl get certificates
    NAME                  READY   SECRET                AGE
    wordpress.local-tls   True    wordpress.local-tls   9m ’
</code></pre>
<p>Then, switch the issuer of the certificate to the one that has issued the certificate originally as below: -</p>
<pre><code>   ‘ # kubectl edit ing blog-wordpress ’
</code></pre>
<p>And update the annotation as below: -</p>
<pre><code>  ‘ certmanager.k8s.io/cluster-issuer: letsencrypt-prod ’
</code></pre>
<p>Once the ingress manifest is updated, then the certificate manifest will automatically be updated. To verify it, open the manifest for <strong>‘wordpress.local-tls’</strong> certificate resource as below: -</p>
<pre><code> ‘ kubectl edit certificate wordpress.local-tls ’
</code></pre>
<p>The issuer will be seen as updated as below: -</p>
<pre><code>‘ kubectl edit certificate wordpress.local-tls ’
</code></pre>
<p>Thus, in this way, you will be able to import a certificate secret in AKS. For more details, I would suggest you to please refer the below link for more details: -</p>
<p><a href="https://github.com/vmware-archive/kube-prod-runtime/issues/532" rel="nofollow noreferrer">https://github.com/vmware-archive/kube-prod-runtime/issues/532</a></p>
