<p>I obtained Intermediate SSL certificate from SSL.com recently. I'm running some services in AKS (Azure Kubernetes Service) Earlier I was using Let's Encrypt as the CertManager, but I want to use SSL.com as the CA going forward. So basically, I obtained chained.crt and the private.key</p>
<p>The chained.crt consists of 4 certificates. Like below.</p>
<pre><code>-----BEGIN CERTIFICATE-----
abc
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
def
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
ghi
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
jkl
-----END CERTIFICATE-----
</code></pre>
<p>The first step was, I created a secret as below. The content I added in tls.crt and tls.key was base64 decoded data.</p>
<pre><code>cat chained.crt | base64 | tr -d '\n'
cat private.key | base64 | tr -d '\n' 


apiVersion: v1
kind: Secret
metadata:
 name: ca-key-pair
 namespace: cert
data:
 tls.crt: &lt;crt&gt;
 tls.key: &lt;pvt&gt;
</code></pre>
<p>Then eventually I created the Issuer by referring the secret I created above.</p>
<pre><code>apiVersion: cert-manager.io/v1beta1
kind: Issuer
metadata:
  name: my-issuer      
  namespace: cert
spec:
  ca:
    secretName: ca-key-pair
</code></pre>
<p>The issue I'm having here is, when I create the Issuer, it gives an error like this</p>
<pre><code>Status:
  Conditions:
    Last Transition Time:  2022-01-27T16:09:02Z
    Message:               Error getting keypair for CA issuer: certificate is not a CA
    Reason:                ErrInvalidKeyPair
    Status:                False
    Type:                  Ready
Events:
  Type     Reason             Age                From          Message
  ----     ------             ----               ----          -------
  Warning  ErrInvalidKeyPair  18s (x2 over 18s)  cert-manager  Error getting keypair for CA issuer: certificate is not a CA
</code></pre>
<p>I searched and found this too <a href="https://stackoverflow.com/questions/45796058/how-do-i-add-an-intermediate-ssl-certificate-to-kubernetes-ingress-tls-configura">How do I add an intermediate SSL certificate to Kubernetes ingress TLS configuration?</a> and followed the things mentioned here too. But still getting the same error.</p>

Container-Man
<p>Perfect! After spending more time on this, I was lucky enough to make this work. So in this case, you don't need to create an Issuer or ClusterIssuer.</p>
<p>First, create a TLS secret by specifying your private.key and the certificate.crt.</p>
<pre><code>kubectl create secret tls ssl-secret --key private.key --cert certificate.crt
</code></pre>
<p>After creating the secret, you can directly refer to that Secret in the Ingres.</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: frontend-app-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/proxy-body-size: 8m
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
spec:
  tls:
  - hosts:
    - &lt;domain-name&gt;
    secretName: ssl-secret
  rules:
  - host: &lt;domain-name&gt;
    http:
      paths:
      - backend:
          serviceName: backend
          servicePort: 80
        path: /(.*)
</code></pre>
<p>Then verify if everything's working. For me the above process worked.</p>
