Let's Encrypt is a certificate authority that provides free SSL/TLS certificates via an automated process. Their certificates are accepted by most of todays browsers.
APPUiO provides integration with Let's Encrypt to automatically create, sign, install and renew certificates for your domains running on APPUiO.
To create a certificate for one of your domains follow these steps:
- If you haven't already done so create a route for the fully qualified domain
name (FQDN), e.g.
www.example.org, your application should run under - Add a CNAME record (important!) for the FQDN to the DNS of your domain
pointing to
cname.appuioapp.ch. E.g. in BIND:www IN CNAME cname.appuioapp.ch.(the trailing dot is required) - Annotate your route:
oc -n MYNS annotate route ROUTE kubernetes.io/tls-acme=true
Creating certificates for the default domain appuioapp.ch is neither needed
nor supported as APPUiO already has a wildcard certificate installed for
*.appuioapp.ch.
Without this wildcard certificate we would hit the
Let's Encrypt rate limits on the
appuioapp.ch domain sooner or later.
Important: Always create a route before pointing a DNS entry to APPUiO and always remove the corresponding DNS entry before deleting a route for a domain of yours. Otherwise someone else could potentially create a route and a Let's Encrypt certificate for your domain.
Please note:
- APPUiO automatically renews certificates a few days before they expire
- Let's encrypt can only create domain validated certificates, i.e. it's not possible to add an organization name to a Let's Encrypt certificate.
APPUiO uses the OpenShift ACME controller to provide the Let's Encrypt integration. We automated the installation using a Ansible Role ansible-role-openshift-acme which deploys the Docker Image.
The ACME account and the certificates are stored as secret in the corresponding project, that allows you to re-use these certificates for other applications running on APPUiO.