Course Overview

Learn how to run PKI and TLS properly on Kubernetes and OpenShift: from the control-plane certificates the platform issues for itself, through the Service CA Operator and cert-manager, to keystores and truststores inside your applications. Platform engineers and SREs learn to issue, distribute, rotate and monitor certificates, troubleshoot broken chains and trust, and put the governance in place that prevents the next expiry outage.

Who should attend

Platform engineers, cluster administrators, SREs and security engineers who operate Kubernetes or OpenShift clusters and are responsible for the certificates, keys and trust stores on them, as well as developers who need to consume those certificates correctly from their applications.

What you'll learn

• Explain/Recap X.509 certificates, chains of trust, keystores and truststores, and the TLS handshake with confidence
• Map every place a certificate lives in a cluster, from the control plane to the ingress edge and workload-to-workload traffic
• Understand how OpenShift issues and rotates its own certificates and use the Service CA Operator for internal TLS
• Deploy cert-manager with CA, ACME and enterprise issuers and automate issuance, renewal and rotation
• Distribute trust to workloads with trust-manager, ClusterTrustBundles and OpenShift's CA bundle injection
• Consume certificates from applications, with Java and the JVM as the worked example
• Monitor certificate expiry with Prometheus and alert before it hurts
• Troubleshoot chain, SAN, trust-store and webhook failures systematically
• Define a certificate governance model covering ownership, policy, approval and CA rollover

Course Prerequisites

Students should be comfortable using Kubernetes and understand the basic objects such as pods, deployments, services, ingress and secrets. We recommend our Core Kubernetes course. Prior OpenShift or OKD experience is helpful but not required; the OpenShift-specific material is introduced from first principles.

Outline

Expired certificates are still one of the most common causes of production outages, and Kubernetes multiplies the problem: a single cluster carries certificates for its control plane, its webhooks and aggregated APIs, its ingress edge, and increasingly for every workload talking to every other workload. OpenShift adds a layer of automation on top, which is a blessing until you need to understand what it is doing and why it stopped.

This course gives platform and security teams a complete, coherent picture of certificate and trust management in a cluster. We start by formalising the theory that most engineers have picked up piecemeal: what a certificate actually asserts, how a chain is built and verified, what a truststore is as opposed to a keystore, and what happens in a TLS handshake. From there we map every area of the cluster where certificates appear and who is responsible for each, before going deep on the tools that manage them: the OpenShift cluster operators and the Service CA Operator, cert-manager and trust-manager, and the enterprise PKI they integrate with.

In line with our teaching philosophy, we go one layer deeper than the abstraction. You will not only annotate a Service for the Service CA Operator but understand why OpenShift needed its own CA from the moment the cluster boots; you will not only create a Certificate resource but follow it through CertificateRequest, Order and Challenge so that you can diagnose it when it stalls.

The course is generic by design so that it applies to any Kubernetes distribution, with OpenShift covered in depth. Labs and demos run on OKD, the community distribution behind OpenShift. On the application side, Java and the JVM are the worked example for keystores, truststores and hot reload; the concepts transfer to other runtimes, which we discuss. It fits in our cloud curriculum after Core Kubernetes and complements Kubernetes Administration; mutual TLS inside a service mesh is introduced here and covered fully in Using Istio Service Mesh on k8s.

PKI and TLS Foundations

• Appreciate the rationale of public-key cryptography
• Distinguish private/public keys, CSRs and certificates
• Understand the structure of an X.509 certificate
• Use Subject Alternative Names (as apposed to the CN i)
• Interpret Key Usage and Extended Key Usage
• Understand root, intermediate and leaf certificates
• Follow chain building and path validation
• Distinguish a keystore from a truststore
• Compare PEM, DER, PKCS#12 and JKS
• Walk through the TLS 1.3 handshake
• Distinguish server-side TLS from mutual TLS
• Discuss revocation (CRL, OCSP) versus short lifetimes
• Contrast public CAs and ACME with a private PKI
• Explore certificates with openssl and step

The Certificate Landscape of a Cluster

• Map where certificates live in a cluster and who owns them
• Inspect the control-plane PKI of a kubeadm cluster
• Understand kubelet client and serving certificate rotation
• Use the CertificateSigningRequest API and signers
• Understand the caBundle of webhooks, aggregated APIs and metrics
• Distinguish edge certificates (Ingress, Gateway) from in-cluster ones
• Discuss server-side TLS between workloads
• Introduce mutual TLS through sidecars and service meshes
• Appreciate why OpenShift automates what kubeadm leaves to you
• Identify client certificates in kubeconfigs and their risks
• Store keys in Secrets of type kubernetes.io/tls

OpenShift and OKD: the Platform PKI

• Understand why OpenShift needs internal TLS from first boot
• Discover the cluster operators that manage platform certificates
• Inspect platform certificates and their rotation
• Understand the rationale of the Service CA Operator
• Request serving certificates with serving-cert-secret-name
• Distribute the service CA with inject-cabundle
• Understand Service CA rotation and its grace period
• Replace the default ingress and API server certificates
• Add corporate CAs to the cluster-wide trust bundle
• Trust a registry through additionalTrustedCA
• Distinguish edge, passthrough and re-encrypt Routes
• Troubleshoot certificates with the console and oc

cert-manager

• Appreciate the rationale of cert-manager
• Understand Issuer, Certificate, CertificateRequest, Order and Challenge
• Configure the SelfSigned and CA issuers
• Configure an ACME issuer with HTTP-01 and DNS-01
• Extend DNS-01 with a webhook solver for your DNS provider
• Integrate an enterprise PKI through the Vault and external issuers
• Control renewal with duration and renewBefore
• Manage private key rotation and algorithms
• Secure Ingress and Gateway listeners with the ingress-shim
• Install the cert-manager Operator for OpenShift with Route support
• Compare cert-manager with the Service CA Operator
• Distribute CA bundles with trust-manager
• Introduce the ClusterTrustBundle API
• Mount short-lived certificates with the csi-driver
• Troubleshoot with cmctl and status conditions

Consuming Certificates from Applications (Java/JVM)

• Mount TLS Secrets as projected volumes
• Understand how the JVM resolves its truststore and keystore
• Build PKCS#12 keystores and truststores from PEM
• Extend the cacerts truststore safely
• Configure TLS in Spring Boot with SSL bundles
• Implement hot reload of certificates without a restart
• Resolve PKIX path building failed and its friends
• Discuss the equivalents in other runtimes (Node.js, Python, Go, …)
• Terminate TLS in a sidecar
• Position a service mesh as the mTLS and identity layer
• Appreciate SPIFFE/SPIRE workload identity
• Discuss application TLS versus sidecar and ambient modes

Expiry Monitoring and Alerting

• Appreciate why expiry causes most certificate outages
• Alert on cert-manager metrics with Prometheus
• Deploy the x509-certificate-exporter
• Use the built-in OpenShift alerts for platform certificates
• Monitor kubelet and control-plane rotation
• Design alert routing to the owning team

Troubleshooting

• Diagnose TLS failures with openssl s_client
• Recognise SAN mismatch, missing intermediates and clock skew
• Resolve JVM PKIX errors and their equivalents elsewhere
• Troubleshoot a cert-manager Certificate stuck in Ready: False
• Debug failing ACME challenges
• Debug a webhook with a stale caBundle
• Diagnose silent Service CA injection failures
• Troubleshoot re-encrypt Routes
• Recover expired control-plane certificates
• Work through break-and-fix scenarios

Governance (Discussion)

To close the course we step back from the tooling for a chalk-and-talk session: no labs, but a guided discussion with the group on how certificate management could be organised in your organisation.

• Keep a certificate inventory and assign ownership
• Agree policy for lifetimes, algorithms and naming
• Enforce policy with approver-policy and RBAC
• Apply separation of duties around issuers
• Fit the cluster into the enterprise PKI hierarchy
• Plan a CA rollover
• Handle certificates in GitOps without leaking keys
• Maintain runbooks for rotation and incidents
• Produce audit and compliance evidence
• Discuss the impact of post-quantum cryptography

Frequently asked questions