title: Use HTTPS for Kubernetes nginx-ingress
body: <p>I want to use HTTPS for my Kubernetes on Azure (AKS).
  For that I use nginx-ingress (<a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/deploy/index.md#azure" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/blob/master/docs/deploy/index.md#azure</a>).
  All of the ressources, which I created by this tutorial, are using the namespace ingress-nginx. That's why I continue using this namespace instead of default.
  My Ingress is working like expected. Now I want to use HTTPS instead of HTTP.</p>
  
  <p>For that I created an CSR:</p>
  
  <pre><code>openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out example.csr -subj "/CN=domain.com"
  </code></pre>
  
  <p>I send the CSR to a signing provider (QuoVadis) who send me the following files back:</p>
  
  <ul>
  <li>domain_com(chain).crt </li>
  <li>domain_com.crt </li>
  <li>QuoVadis_Global_SSL_ICA_G2.crt</li>
  <li>QuoVadis_Root_CA_2.crt</li>
  </ul>
  
  <p>I'm a little bit confused because in all tutorials I found only one crt is mentioned. The chain looks like an combination of all other three files. That's why I continued with the chain:</p>
  
  <pre><code>sudo kubectl create secret tls ssl-secret-test --cert domain_com(chain).crt --key private.key -n ingress-nginx
  </code></pre>
  
  <p>I added the secret to my ingress:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: nginx-ingress
    namespace: ingress-nginx
    annotations:
      nginx.ingress.kubernetes.io/rewrite-target: /$2
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
  spec:
    tls:
    - hosts:
      - domain.com
      secretName: ssl-secret-test
    rules:
    - host: domain.com
    - http:
        paths:
        - path: /app1(/|$)(.*)
          backend:
            serviceName: app1-service
            servicePort: 80
        - path: /app2(/|$)(.*)
          backend:
            serviceName: app2-service
            servicePort: 80
  </code></pre>
  
  <p>My deployments app1 &amp; app2 are not available by the domain anymore. If I use the IP it is still working:</p>
  
  <p><strong>domain.com/app1:</strong></p>
  
  <p><em>404 Not Found - openresty/1.15.8.1</em></p>
  
  <p><strong>52.xxx.xxx.xx/app1:</strong></p>
  
  <p><em>Hello World</em></p>
  
  <p>In both cases, I still get the warning of an unsecured connection. 
  Here an overview of my services:</p>
  
  <pre><code>$ sudo kubectl get svc --all-namespaces
  NAMESPACE       NAME                             TYPE           CLUSTER-IP     EXTERNAL-IP                                  PORT(S)                      AGE
  default         kubernetes                       ClusterIP      10.0.0.1       &lt;none&gt;                                       443/TCP                      57d
  ingress-nginx   app1-service                     NodePort       10.0.229.109   &lt;none&gt;                                       80:31343/TCP                 22h
  ingress-nginx   app2-service                     NodePort       10.0.175.201   &lt;none&gt;                                       80:31166/TCP                 22h
  ingress-nginx   ingress-nginx                    LoadBalancer   10.0.40.172    52.xxx.xxx.xx                                80:32564/TCP,443:32124/TCP   22h
  kube-system     healthmodel-replicaset-service   ClusterIP      10.0.233.181   &lt;none&gt;                                       25227/TCP                    5d10h
  kube-system     heapster                         ClusterIP      10.0.214.146   &lt;none&gt;                                       80/TCP                       57d
  kube-system     kube-dns                         ClusterIP      10.0.0.10      &lt;none&gt;                                       53/UDP,53/TCP                57d
  kube-system     kubernetes-dashboard             ClusterIP      10.0.160.230   &lt;none&gt;                                       80/TCP                       57d
  kube-system     metrics-server                   ClusterIP      10.0.170.103   &lt;none&gt;                                       443/TCP                      57d
  
  $ sudo kubectl get ingress --all-namespaces
  NAMESPACE       NAME            HOSTS              ADDRESS         PORTS     AGE
  ingress-nginx   nginx-ingress   domain.com         52.xxx.xxx.xx   80, 443   37m
  
  $ sudo kubectl get deployments --all-namespaces
  NAMESPACE       NAME                       DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
  ingress-nginx   app1                       2         2         2            2           22h
  ingress-nginx   app2                       2         2         2            2           22h
  ingress-nginx   nginx-ingress-controller   1         1         1            1           57d
  kube-system     coredns                    2         2         2            2           58d
  kube-system     coredns-autoscaler         1         1         1            1           58d
  kube-system     heapster                   1         1         1            1           5d10h
  kube-system     kubernetes-dashboard       1         1         1            1           58d
  kube-system     metrics-server             1         1         1            1           58d
  kube-system     omsagent-rs                1         1         1            1           58d
  kube-system     tunnelfront                1         1         1            1           58d
  </code></pre>
  
  <p>What I'm doing wrong?</p>
  
  <h1>Update with cert-manager</h1>
  
  <p>I followed the following tutorial:</p>
  
  <p><a href="https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html" rel="nofollow noreferrer">https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html</a></p>
  
  <p>and confirmed everything by the example test-resources.yaml.</p>
  
  <p>Now I followed the steps for setting up a CA ISSUER.</p>
  
  <pre><code>apiVersion: certmanager.k8s.io/v1alpha1
  kind: Certificate
  metadata:
    name: domain-com
    namespace: default
  spec:
    secretName: domain-com-tls
    issuerRef:
      name: ca-issuer
      kind: ClusterIssuer
    commonName: domain.com
    organization:
    - QuoVadis
    dnsNames:
    - domain.com
    - www.domain.com
  -----
  apiVersion: certmanager.k8s.io/v1alpha1
  kind: ClusterIssuer
  metadata:
    name: ca-issuer
    namespace: default
  spec:
    ca:
      secretName: ssl-secret-test
  </code></pre>
  
  <p>But it seems that it is not working:</p>
  
  <pre><code>$ kubectl describe certificate domain-com
  ...
  Status:
    Conditions:
      Last Transition Time:  2019-09-12T07:48:19Z
      Message:               Certificate does not exist
      Reason:                NotFound
      Status:                False
      Type:                  Ready
    Not After:               2021-09-11T07:46:00Z
  Events:
    Type     Reason          Age                 From          Message
    ----     ------          ----                ----          -------
    Warning  IssuerNotReady  8s (x9 over 4h51m)  cert-manager  Issuer ca-issuer not ready
  </code></pre>
  
  <p>And on the troubleshooting page, I found an additional uncertainty:</p>
  
  <pre><code>$ kubectl --namespace cert-manager get secret cert-manager-webhook-webhook-tls
  Error from server (NotFound): secrets "cert-manager-webhook-webhook-tls" not found
  </code></pre>