<p>I want to create a HTTPS Ingress for my microservice infrastructe, on Google Kubernetes Engine, for my <strong>test</strong> environment. Basic HTTP Ingress works fine and now I want to create a secure one. I don't have a domain, I want my UI to make requests via https directly on the Ingress IP.</p>
<p>I've used Let's Encrypt (sslforfree website) to create a certificate for an IP that was accessible to me. But this ip i've used for the domain name in the certificate is not the IP on which the Ingress was created. Now all requests return 401 and I don't know why. First error the browser returns is the following:</p>
<pre><code>Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for 35.241.60.223. The certificate is only valid for 35.228.159.214.
 
Error code: SEC_ERROR_UNKNOWN_ISSUER
</code></pre>
<p>This is the problem: if I want to create an Ingress, on GKE, on HTTPS, I need a certificate. But I can't have the certificate until I know the Ingress IP.</p>
<p>I don't have much experience in HTTPS and Ingress and I don't know what is the easiest way for me to have a HTTP Ingress, in my test environment, without having any domain name.</p>
<p>Edit: I've created a domain comanddev.tk and forwarded that to ingress url location. I've created a certificate for comanddev.tk and updated ingress to use that certificate. Now the request is getting ERR_TIMEDOUT and I don't see anything in the Ingress Controller logs of use except <code>GET https://35.241.60.223/customer-service/actuator/health 401</code></p>

2dor
<p>As of my knowledge you cannot use Let's Encrypt for a certificate for only an IP address. You need a domain name as the certificate is used to &quot;proof&quot; you ownership or control over this domain.
See <a href="https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-name/6082/14" rel="nofollow noreferrer">https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-name/6082/14</a>
Your options would be to use self signed SSL certificates or register some kind of cheap (sub)domain for testing purposes which you can then point to the ingress IP.</p>
