From a99e37cb0892419867846c5e111ae79fe7ebb041 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 24 Jul 2018 23:49:17 +0200 Subject: [PATCH] Add --no-cacerts to single install without external LB --- .../en/installation/single-node-install/_index.md | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index c9d505d1254..6e16cafbc2f 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -118,6 +118,7 @@ If you're publishing your app publicly, you should ideally be using a certificat > >- The certificate files must be in [PEM format](#pem). >- Make sure that the container includes your certificate file and the key file. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary. +>- Add `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. **To Install Rancher Using a Certificate Signed by a Recognized CA:** @@ -128,17 +129,9 @@ If you're publishing your app publicly, you should ideally be using a certificat -p 80:80 -p 443:443 \ -v /etc/your_certificate_directory/fullchain.pem:/etc/rancher/ssl/cert.pem \ -v /etc/your_certificate_directory/privkey.pem:/etc/rancher/ssl/key.pem \ - rancher/rancher:latest + rancher/rancher:latest --no-cacerts ``` -By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. - -**To Remove the Default Certificates:** - -1. Log into Rancher. -2. Select **Settings** > **cacerts**. -3. Choose `Edit` and remove the contents. Then click `Save`. - ### Option D—Let's Encrypt Certificate Rancher supports Let's Encrypt certificates. Let's Encrypt uses an `http-01 challenge` to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.