<p>I have established kubernetes cluster on one of the private hosting machine with public IP. I installed a few applications there and NGINX as the ingress controller. I would like to make a reachable my services outside of the cluster and be accessible with the specific domain. I installed cert-manager via helm and requested certificate via letsencrypt-prod, (validated domain via http-01 resolver) everything looks perfect (clusterissuer. certificate, certificaterequest, challenge) but from some reason, my TLS secret after BASE64 decoding - contains three certificates in the following order:</p>
<pre><code>-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
</code></pre>
<p>which is incorrect, as far as I know - it should be only two certificates (instead of 3), any ideas what can be wrong with that?</p>

corey
<p>There's nothing wrong with it. You are seeing the root certificate, intermediate certificate, and your subscriber certificate.</p>
<p>It's actually normal for certificate authorities to use intermediate certificates.</p>
<p>You can read about it here: <a href="https://letsencrypt.org/certificates/" rel="nofollow noreferrer">https://letsencrypt.org/certificates/</a></p>
