Certificates in OpenShift

OpenShift uses several different certificates to make the platform secure. In this section, we will walk through the main certificate chains OpenShift uses. These are presented here:

• API server: Certificate used with the OpenShift API, usually accessible at https://api. <cluster-name>.<domain>:6443/.
• Ingress: Certificate valid for application’s domain. It is usually a wildcard certificate for *.apps.<cluster-name>.<domain>.
• Node certificates: Managed automatically by the cluster and don’t require any user intervention. Automatically rotated.
• etcd certificates: Used to encrypt communication between etcd cluster members. Automatically managed and rotated by the cluster itself.

OpenShift creates self-signed certificates with the platform installation. Most enterprises require those certificates to be replaced by custom certificates. To do so, refer to the OpenShift documentation, as follows:

...