Unable to create certificate using ingress annotations - MalformedCSRException: CSR must mark the SAN extension critical when it has an empty subject about aws-privateca-issuer HOT 8 CLOSED

Turns out that this is resolvable by doing below:

apiVersion: extensions/v1beta1
# apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/issuer: myprivate-ca
    cert-manager.io/issuer-kind: AWSPCAClusterIssuer
    cert-manager.io/issuer-group: awspca.cert-manager.io
    cert-manager.io/common-name: podinfo.infrastructure.com
  name: podinfo
  namespace: podinfo
spec:
  rules:
  - host: podinfo.infrastructure.com
    http:
      paths:
      - path: /
        backend:
          serviceName: podinfo
          servicePort: 80
  tls:
    - hosts:
      - podinfo.infrastructure.com
      secretName: podinfo10

Main change being adding the extra annotation cert-manager.io/common-name: podinfo.infrastructure.com
Happy for this to be closed perhaps with an example of generating cert this way.

from aws-privateca-issuer.

Just ran into the same issue and adding the cert-manager.io/common-name annotation fixed it. Thanks!

from aws-privateca-issuer.

Hi,
I haven't actually tested this before. Can you post both of the CertificateRequest CRs that are created?
I can probably check why it's not working from there.

from aws-privateca-issuer.

Not sure I know exactly what to post whilst keeping sensitive information off. It is easy to test it as documented here https://cert-manager.io/docs/usage/ingress/#how-it-works

from aws-privateca-issuer.

I'll have to try and reproduce it later this week then.

from aws-privateca-issuer.

@jniebuhr - any chance you got round to looking at this?

from aws-privateca-issuer.

Thanks for the update.

from aws-privateca-issuer.

I noticed that I need to add a commonName to the Certificate for it to avoid the CSR error

The cert-manager docs show that the commonName is deprecated so initially I didn't use it.

https://cert-manager.io/docs/usage/certificate/

  # The use of the common name field has been deprecated since 2000 and is
  # discouraged from being used.
  commonName: example.com

In teleport 9.x, you have to set .Values.highAvailability.certManager.addCommonName = true since it's false by default

And set the following usages in certificate.yaml

  usages:
  - server auth
  - client auth

from aws-privateca-issuer.