Possibility to provide full chain with self-issuer CA

[RAE-SMC]

Possibility to provide full chain with self-issuer CA

[mvrk69]

I have the same issue, homeassistant for example requires a fullchain (ca + cert) and a separate key on its configuration:

http:
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pem

Is there anyway to accomplish this with cert-manager?

[erikgb]

I think the additional output formats feature in cert-manager could be used to produce "special" output formats like the full chain. This feature is graduated to beta in cert-manager 1.15 - which means it's enabled by default.

[svvac]

It appears cert-manager is already building a full chain into tls.crt.

The issue is that root (self-signed) certificates are omitted from the chain:

cert-manager/pkg/util/pki/parse_certificate_chain.go

Lines 168 to 172 in 356f741

	// Root certificates are omitted from the chain as per
	// https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.2
	// > [T]he self-signed certificate that specifies the root certificate authority
	// > MAY be omitted from the chain, under the assumption that the remote end must
	// > already possess it in order to validate it in any case.

[erikgb]

The issue is that root (self-signed) certificates are omitted from the chain

Is this really an issue? 😉

[svvac]

Well, I guess it somewhat gets in the way of this feature request, don't you think? Some use-cases would benefit from a way to selectively disable that behavior.

[erikgb]

That's why I suggested the additional output formats in #6876 (comment). This feature was actually graduated to beta in recent cert-manager 1.15.

[japtain-cack]

+1 for this. I have client's that can't manage a cert store, and I need the full chain including the root. We use a Vault PKI for our CAs ftr.