ingress-nginx: Error generating CA certificate chain

BUG REPORT:
--enable-ssl-chain-completion don’t respect ingress annotation kubernetes.io/ingress.class

NGINX Ingress controller version: 0.19.0

Kubernetes version (use kubectl version): v1.11.2

Environment:

Cloud provider or hardware configuration: vSphere
OS (e.g. from /etc/os-release): rancherOS
Kernel (e.g. uname -a): Linux pws2 4.14.67-rancher2
Install tools: Rancher 2.0.8
Others:

What happened: I have multiple ingress controllers configured with different --ingress-class and ingress resource with kubernetes.io/ingress.class annotation. But all controllers trying to check certificate chain for certificate referenced in that ingress resource.
I found this message in logs of each controller:

backend_ssl.go:161] Error generating CA certificate chain for Secret "mynamespace/mysecret": Invalid certificate.

where secret mynamespace/mysecret referenced only in one ingress with specified kubernetes.io/ingress.class annotation.

What you expected to happen: Error message must appears only in controller’s log specified with kubernetes.io/ingress.class annotation.

About this issue

Original URL
State: closed
Created 6 years ago
Reactions: 4
Comments: 35 (2 by maintainers)

Most upvoted comments

/remove-lifecycle rotten

frittentheke on Jul 29, 2019

Here we face the issue of having a certificate without the certificate authority running on a Kubernetes. We did following steps:

Concatenate both certificate and the certificate authority, in a temp file:

-----BEGIN CERTIFICATE-----
...(here is your certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...(here is your authority certificate)...
-----END CERTIFICATE-----

Encode to base64 in terminal:

cat some_temp_file | base64 -w 0

Put the resulting base64 in your Ingress deployment configuration at property “data.tls.crt”:

apiVersion: v1
data:
  tls.crt: ... <-- here
  tls.key: ...
kind: Secret
metadata:
  name: sslcerts
type: Opaque

viniciusps2 on Mar 14, 2019

We had a similar experience turning it off, but I also didn’t pay attention to or dig in to find the side effects of leaving it disabled.

We had to re-enable chain completion due to some additional requirements and used your Dockerfile snippet above and haven’t seen any errors in our logs (other than ingress rules with typo’d secret names or the like).

I’ll take a look at the Dockerfile in question and see if there was anything different we did that would resolve the errors.

amargherio on Jan 18, 2019

Do we have an ETA on this ?

prbajrac on Jan 8, 2019

+1 same here. works fine, just getting the error

jseparovic on Dec 26, 2018