Setting up certificates with cert-manager and Let’s Encrypt
cert-manager automates certificate requests from Let’s Encrypt, a free and automated Certificate Authority.
Okteto requires a wildcard certificate, so you must use a DNS01 auth method in your Issuer. See the list of supported DNS01 providers for compatible options.
The Okteto community maintains guides on using cert-manager with different cloud providers:
Configure Okteto to use your certificate
Each guide creates a cert-manager Certificate that stores the issued certificate in a secret named okteto-letsencrypt. Once cert-manager has issued it, add the following to your Helm configuration file to tell Okteto and NGINX to use your certificate:
wildcardCertificate:
create: false
name: okteto-letsencrypt
ingress-nginx:
controller:
extraArgs:
default-ssl-certificate: $(POD_NAMESPACE)/okteto-letsencrypt
Both settings are required. wildcardCertificate.create: false stops Okteto from generating its self-signed certificate, which also removes the secret that default-ssl-certificate points at. If you don't update that argument as well, the ingress controller falls back to its own built-in fake certificate. This fails quietly: cert-manager reports your certificate as Ready, and the hosts Okteto creates ingresses for still serve it over SNI, but any request that doesn't match one of those hosts shows a certificate warning.
Finally, upgrade your Okteto installation for the new configuration to be applied.
This video tutorial walks through configuring certificates for Okteto using cert-manager and Let's Encrypt: