SSL

Managing Internal TLS Trust in Kubernetes with cert-manager and trust-manager How do you maintain a secure SSL/TLS connection between services within a Kubernetes cluster? One simple (but unsafe) answer is to create a self-signed certificate and skip verification with a flag like --insecure-skip-tls-verify. A more advanced solution is to use a service mesh (e.g., Linkerd, Istio), which automatically manages certificates and trust. But what if you want something simpler and lighter? That’s where trust-manager comes in. It’s the easiest way to manage trust bundles in Kubernetes and OpenShift clusters. ...

On Aug 12, 2025, NGINX announced native support for the ACME protocol: https://blog.nginx.org/blog/native-support-for-acme-protocol This is a great improvement because you no longer need extra tools to issue SSL certificates. The first release supports only the HTTP-01 challenge, so wildcard certificates are not possible yet. For wildcards you need DNS-01 with DCV delegation . Let’s see how it works. ...

When you need to get a certificate from a service like Let’s Encrypt, you must validate ownership of the domains for which you are issuing a certificate. This is achieved using challenges. But what types of challenges are available? 1. HTTP-01 Challenge The most common and widely used type is the HTTP-01 challenge. With this method, you receive a token that must be placed in your web server at the following path: ...