<p>I have a spring boot application running on kubernetes, a client application serving a react app and proxying request to other services.</p>
<p>That client app is avalaible through an Ingress using a Nginx controller.
I have a domain name targetting the Nginx controler service and I've been able to generate a valid certificate and key with cert-manager from let's encrypt, also the certificate and key is automaticly updated when it's necessary.</p>
<p>Till now I used self signed certificates generated with keytool to secure the communication between my differents applications (I guess I can still use that tools for internal communications), but for the client app I need to use the let's encrypt generated key.</p>
<p>Now my client app does not use ssl (ssl.enable is false in my bootstrap.yml). So the communication between the Ngix Ingress controller and the client app is not secure I think.</p>
<p>A k8s secret has been created with a certificate and a key during the process so I guess I can use it but what is the best way ? I would also like to provit the automatic update of the certificate if it's possible.</p>
<p>Thanks for your advices</p>

kaizokun
<p>There are clients out there which re-use the private key used previously (certbot when used with the <strong>--reuse-key</strong> option and also acme.sh). Unless someone knows a client with such a feature, you should check the clients from the list and see if the client makes importing an existing private key possible. Or at least not very difficult.</p>

<p>Certbot would need an issued certificate first to re-use the key. What could be a working option is:</p>

<ul>
<li>install certbot (see <a href="https://certbot.eff.org/" rel="nofollow noreferrer">https://certbot.eff.org/</a> 29)</li>
<li><p>get a certificate issued with certbot without caring about the keys,
just get it working.</p></li>
<li><p>use --staging for test certificates first manually exchange the PEM
formatted private key in
<strong>/etc/letsencrypt/archive/name-of-your-certificate/privkey1.pem</strong> with
your own PEM formatted private key renew the certificate with certbot
renew <strong>--reuse-key</strong></p></li>
<li>check if the public key in the renewed certificate corresponds with
your own public/private key If the above checks out (with the
<strong>--staging</strong> option for testing), you can remove the test certificate and do the above again, but without <strong>--staging</strong> to get a real working
certificate.</li>
</ul>

<p>Useful documentations <a href="https://docs.cert-manager.io/en/latest/tutorials/acme/quick-start/" rel="nofollow noreferrer">cert-manager</a>, <a href="https://certbot.eff.org/about/" rel="nofollow noreferrer">certbot</a>.</p>
