- Print the certificate data to stdout:
openssl x509 -in <filename.pem> -text -noout
Check & print remote certificate
openssl s_client -connect <hostname>:<port> -showcerts
Every Kubernetes cluster has a cluster root Certificate Authority (CA). The CA is generally used by cluster components to validate the API server’s certificate, by the API server to validate kubelet client certificates, etc. To support this, the CA certificate bundle is distributed to every node in the cluster and is distributed as a secret attached to default service accounts. Optionally, your workloads can use this CA to establish trust. Your application can request a certificate signing using the certificates.k8s.io API using a protocol that is similar to the ACME draft.
Für den Fall, dass das noch jemand anderes benötigt.
Um andere Certificate Authorities (CAs) zu Linux hinzuzufügen, sind nur kleine Schritte nötig. Hier einmal am Beispiel CAcert.