Setting up certificates with cert-manager and Let’s Encrypt
cert-manager automates certificate requests from Let’s Encrypt, a free and automated Certificate Authority.
Okteto requires a wildcard certificate, so you must use a DNS01 auth method in your Issuer. See the list of supported DNS01 providers for compatible options.
The Okteto community maintains guides on using cert-manager with different cloud providers:
Configure Okteto to use your certificate
Create your Certificate resource in the namespace where Okteto is installed. Once cert-manager has issued it, the certificate is stored in the secret named by the Certificate's spec.secretName. Add the following to your Helm configuration file, replacing your-ssl-certificate-secret with that name, to tell Okteto and NGINX to use your certificate:
wildcardCertificate:
create: false
name: your-ssl-certificate-secret
ingress-nginx:
controller:
extraArgs:
default-ssl-certificate: $(POD_NAMESPACE)/your-ssl-certificate-secret
Both settings are required. wildcardCertificate.create: false stops Okteto from generating its self-signed certificate, which also removes the secret that default-ssl-certificate points at. If you don't update that argument as well, the ingress controller falls back to its own built-in fake certificate. This fails quietly: cert-manager reports your certificate as Ready, and the hosts Okteto creates ingresses for still serve it over SNI, but any request that doesn't match one of those hosts shows a certificate warning.
Finally, upgrade your Okteto installation for the new configuration to be applied.
This video tutorial walks through configuring certificates for Okteto using cert-manager and Let's Encrypt: