Upload existing certificate?

[huang-jy]

Not filing this as a bug or feature, but as a question.

Is it possible to add an existing certificate purchased outside of CM? e.g. Symantec, NetName, etc.

[euank]

cert-manager stores certificates as Kubernetes secrets. It doesn't really do anything special for the storage portion of it.

The main value cert-manager adds is automatic creation of those certificates and automatic renewal before they expire.
In the case of certificates that are purchased through a human process, cert-manager can neither automate renewal nor issuance, so I don't think it helps much.

For just using such a certificate in Kubernetes, something like kubectl create secret tls my-certificate --key=keyfile --cert=certfile might be what you want.

In theory, cert-manager can "adopt" a certificate it didn't create (for example if you wish to switch from symantic to lets-encrypt, you could have cert-manager replace the symantic certificate with a lets-encrypt issued one before it expires).
However, I don't think that use-case is something that's being designed for, so it might break in an unexpected way or not work in the future.

Does that answer the question you had?

[huang-jy]

Yes, if I replaced the LE cert, CM would still replace it when it thinks it expired.

I'll try that create secret tls command, thanks 👍

[yob]

We're planning to migrate some web services into a cluster with a functioning cert-manager install where only http01 is supported, and we'd like to confirm TLS is working on the new deployment before changing over DNS, so http01 won't work.

In theory, cert-manager can "adopt" a certificate it didn't create (for example if you wish to switch from symantic to lets-encrypt, you could have cert-manager replace the symantic certificate with a lets-encrypt issued one before it expires).

I'm interested in trying this. We'll run some tests where we manually create a cert-manager compatible certificate (with associated secret) using a purchased rapidssl certificate, and see if cert-manager can adopt it (eventually replacing it with a letsencrypt cert).