解决Nginx无法正常使用SSL证书的问题

41次阅读

问题描述

在尝试使用 Kubernetes 集群和 Nginx Ingress Controller 以及 Cert Manager 获取来自 Let’s Encrypt 的 SSL 证书时遇到问题。目前，似乎证书已经颁发，但无法在 Chrome 中正确加载，也无法通过 curl 访问。以下是一些显示当前配置的配置文件，以及一些描述信息。

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager-prod
spec:
  selfSigned: {}

---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: letsencrypt-prod
  namespace: cert-manager-prod
spec:
  commonName: me@example.com <- 这只是示例，请注意实际设置
  secretName: letsencrypt-prod-tls
  issuerRef:
    name: letsencrypt-prod

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/cors-allow-origin: "https://portal.<domain>.com"
    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, PUT, POST, DELETE, PATCH, OPTIONS"
  name: prod-ingress
  namespace: production
spec:
  rules:
  - host: api.<domain>.com
    http:
      paths:
      - backend:
          serviceName: api
          servicePort: 8090
        path: /
  tls:
  - hosts:
    - api.<domain>.com
    secretName: prod-ingress-cert

$ kubectl get certificates
NAME                READY   SECRET              AGE
prod-ingress-cert   False   prod-ingress-cert   30m

Name:         prod-ingress-cert
Namespace:    production
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha2
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-01-26T21:29:07Z
  Generation:          1
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  prod-ingress
    UID:                   adec15ea-4cde-4376-8e6a-306586e57119
  Resource Version:        2780
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/production/certificates/prod-ingress-cert
  UID:                     c86bf4aa-8435-4da0-a822-1a0e9d1df38e
Spec:
  Dns Names:    api.<domain>.com
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt-prod
  Secret Name:  prod-ingress-cert
Status:
  Conditions:
    Last Transition Time:  2020-01-26T21:29:07Z
    Message:               Waiting for CertificateRequest "prod-ingress-cert-1024021523" to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  GeneratedKey  30m   cert-manager  Generated a new private key
  Normal  Requested     30m   cert-manager  Created new CertificateRequest resource "prod-ingress-cert-1024021523"

这里是我能想到可能对解决问题有帮助的所有信息。我应该指出，我有一个类似的设置在开发环境中也在运行（至少在我今天关闭集群之前是这样的）。

解决方案

为了解决无法正常加载 SSL 证书的问题，请按照以下步骤进行操作：

步骤1：检查发行者（Issuer）和证书（Certificate）配置

首先，确保发行者和证书的配置正确。检查您的 Issuer 配置是否引用了正确的集群发行者名称。确保 Certificate 的 spec.issuerRef.name 属性与 Issuer 配置中的名称一致。另外，确保 Certificate 的 spec.secretName 属性正确指向存储 SSL 证书的密钥库。