Sometimes a TLS cert deployed into a Kubernetes cluster in a Secret doesn’t work as expected. Here are some handy commands to verify the certs. The sample commands work for Istio Ingressgateway, but should be adapted to other CNIs without huge efforts.
Commands to verify the cert served by your web-app
# Use openssl to retrieve cert and decrypt and print it out # This can be used to verify that the correct cert is in use in an gateway # use ctrl-c to end it openssl s_client -connect my.example.com:443 -showcerts -servername my.example.com |openssl x509 -noout -text # Print out dates of the cert openssl s_client -connect my.example.com:443 -showcerts -servername my.example.com |openssl x509 -noout -dates # Print out the subject/CN of the cert openssl s_client -connect my.example.com:443 -showcerts -servername my.example.com |openssl x509 -noout -subject # Print out the subjectAltName/SAN of the cert openssl s_client -connect my.example.com:443 -showcerts -servername my.example.com |openssl x509 -noout -text |grep 'Subject Alternative Name' -A1
Commands to verify the cert installed in a secret
# This needs access to secrets so the cert secret can be downloaded and verified
kubectl get secret -n istio-system my-namespace-cert-secret -o yaml
# one-liner to print md5 hash of the X509 modulus from the cert
kubectl get secret -n istio-system my-namespace-cert-secret -o jsonpath={'.data.cert'} |base64 -d | openssl x509 -noout -modulus |openssl md5
# example output
c17642...
# one-liner to print md5 hash of the RSA modulus from the key
# this output has to match the previous one.
kubectl get secret -n istio-system my-namespace-cert-secret -o jsonpath={'.data.key'} |base64 -d | openssl rsa -noout -modulus |openssl md5
# example output
c17642...🙂