TLS certificates

Retrieve ingress hostnames

Run the following command to list all Bob ingress hostnames:

oc get ingress -n <instance-namespace> \
  -o jsonpath='{range .items[*]}{range .spec.rules[*]}{.host}{"\n"}{end}{end}'

Record the returned hostnames — they are required when ordering or generating certificates.

Verify certificate requirements

Ensure the certificate meets the following requirements before applying it to Bob:

• The private key is unencrypted.
• The certificate contains the complete certificate chain.
• All Bob ingress hostnames are included as SAN entries.
• The certificate and key are provided in PEM format.

Create the certificate secret

Create a Kubernetes secret containing the certificate and private key:

oc create secret generic my-tls-secret \
  --from-file=tls.crt=tls.crt \
  --from-file=tls.key=tls.key \
  --from-file=ca.crt=ca.crt \
  -n <instance-namespace>

To update an existing secret:

oc create secret generic my-tls-secret \
  --from-file=tls.crt=tls.crt \
  --from-file=tls.key=tls.key \
  --from-file=ca.crt=ca.crt \
  -n <instance-namespace> \
  --dry-run=client -o yaml | oc apply -f -

Apply the certificate

Configure Bob to use the certificate:

./bobctl setup-route --tls-secret my-tls-secret

Verify the certificate

Verify that the expected certificate is being served:

echo | openssl s_client \
  -connect <hostname>:443 \
  -servername <hostname> 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates

Verify that:

• The issuer is correct.
• The hostname is present in the SAN list.
• The certificate validity dates are correct.

Generate a CA certificate

Generate a private key and self-signed certificate for the certificate authority:

openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes \
  -key ca.key \
  -sha256 \
  -days 365 \
  -out ca.crt \
  -subj "/CN=<BOB_HOSTNAME> CA"

This creates ca.key and ca.crt.

Generate a server private key

Generate an unencrypted private key for the Bob endpoint certificate:

openssl genrsa -out tls.key 4096

If the private key is encrypted with a passphrase, remove the passphrase before continuing:

openssl rsa -in encrypted.key -out tls.key

Create a SAN configuration file

Create a file named san.cnf and replace the placeholder hostnames with the ingress hostnames retrieved earlier:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
CN = <BOB_HOSTNAME_1>

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = <BOB_HOSTNAME_1>
DNS.2 = <BOB_HOSTNAME_2>
DNS.3 = <BOB_HOSTNAME_3>

Add or remove DNS.* entries as required so that all Bob ingress hostnames are included.

Generate a certificate signing request

openssl req \
  -new \
  -key tls.key \
  -out tls.csr \
  -config san.cnf

Sign the certificate

openssl x509 \
  -req \
  -in tls.csr \
  -CA ca.crt \
  -CAkey ca.key \
  -CAcreateserial \
  -out tls.crt \
  -days 365 \
  -extensions v3_req \
  -extfile san.cnf

Create the TLS secret

For certificates issued by a private or corporate certificate authority:

oc create secret generic my-tls-secret \
  --from-file=tls.crt=/path/to/tls.crt \
  --from-file=tls.key=/path/to/tls.key \
  --from-file=ca.crt=/path/to/ca.crt \
  -n <instance-namespace>

For publicly trusted certificates:

oc create secret tls my-tls-secret \
  --cert=/path/to/tls.crt \
  --key=/path/to/tls.key \
  -n <instance-namespace>

Apply the certificate

Configure Bob to use the TLS secret:

./bobctl setup-route --tls-secret my-tls-secret

bobctl validates the secret, updates the Bob configuration, and waits for reconciliation to complete.

Verify the certificate

Verify that Bob is serving the expected certificate:

echo | openssl s_client \
  -connect <BOB_HOSTNAME_1>:443 \
  -servername <BOB_HOSTNAME_1> 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates

Verify that:

• The issuer matches the expected certificate authority.
• The certificate contains the expected hostname entries.
• The certificate validity dates are correct.

If the issuing certificate authority is not trusted by developer workstations, distribute the CA certificate to users before they connect to Bob using bob-ide or bob-shell.

Determine the certificate configuration

Check whether the Bob external endpoint is using a self-signed certificate:

oc get secret bob-external-tls -n <instance-namespace> \
  -o jsonpath='{.data.tls\.crt}' \
  | base64 -d \
  | openssl x509 -noout -issuer

• If the issuer is CN=Bob Internal CA, the cluster is using the default self-signed certificate. Continue with the next step.
• If the issuer is an enterprise or publicly trusted certificate authority, no client-side certificate configuration is required. See User management.

Export the CA certificate

./bobctl get-ca-cert --output bob-ca.crt

Distribute the CA certificate

Provide the exported bob-ca.crt to users and instruct them to add it to their operating system trust store. Users can establish trusted HTTPS connections after importing the Bob CA certificate.