About ACME issuers
The ACME issuer type for the cert-manager Operator for Red Hat OpenShift represents an Automated Certificate Management Environment (ACME) certificate authority (CA) server. ACME CA servers rely on a challenge to verify that a client owns the domain names that the certificate is being requested for. If the challenge is successful, the cert-manager Operator for Red Hat OpenShift can issue the certificate. If the challenge fails, the cert-manager Operator for Red Hat OpenShift does not issue the certificate.
|
|
Private DNS zones are not supported with Let’s Encrypt and internet ACME servers. |
Supported ACME challenges types
To validate domain ownership with ACME issuers, you can use the challenge types supported by the cert-manager Operator for Red Hat OpenShift.
The cert-manager Operator for Red Hat OpenShift supports the following challenge types for ACME issuers:
- HTTP-01
-
With the HTTP-01 challenge type, you provide a computed key at an HTTP URL endpoint in your domain. If the ACME CA server can get the key from the URL, it can validate you as the owner of the domain.
|
|
HTTP-01 requires that the Let’s Encrypt servers can access the route of the cluster. If an internal or private cluster is behind a proxy, the HTTP-01 validations for certificate issuance fail. The HTTP-01 challenge is restricted to port 80. |
- DNS-01
-
With the DNS-01 challenge type, you provide a computed key at a DNS TXT record. If the ACME CA server can get the key by DNS lookup, it can validate you as the owner of the domain.
Supported DNS-01 providers
To configure DNS-01 challenges for ACME issuers, you can validate domain ownership by integrating with supported services, such as Amazon Route 53, Azure DNS, and Google Cloud DNS, or by using Webhooks.
The cert-manager Operator for Red Hat OpenShift supports the following DNS-01 providers for ACME issuers:
-
Amazon Route 53
-
Azure DNS
The cert-manager Operator for Red Hat OpenShift does not support using Microsoft Entra ID pod identities to assign a managed identity to a pod.
-
Google Cloud DNS
-
Webhook
Red Hat tests and supports DNS providers using an external webhook with cert-manager on Red Hat OpenShift Container Platform. The following DNS providers are tested and supported with Red Hat OpenShift Container Platform:
Using a DNS provider that is not listed might work with Red Hat OpenShift Container Platform, but the provider was not tested by Red Hat and therefore is not supported by Red Hat.