From bff02819a487e449dc53fba457846fa86ce05e2e Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Wed, 30 May 2018 21:16:25 +0200 Subject: [PATCH] Fix SSL bugs around self signed and default certificate --- .../single-node-install-external-lb/_index.md | 1 - .../v2.x/en/installation/single-node-install/_index.md | 9 ++++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md index 22232799b9d..f6c44e0625d 100644 --- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md @@ -81,7 +81,6 @@ docker run -d --restart=unless-stopped \ If your cluster is public facing, it's best to use a certificate signed by a recognized CA. >**Prerequisites:** ->Create a self-signed certificate. > >- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). >- The certificate files must be in base64. diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index 87515deaa73..71ec23cc8ec 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -105,7 +105,6 @@ If you're publishing your app publically, you should ideally be using a certific **Before You Start:** >**Prerequisites:** ->Create a self-signed certificate. > >- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). >- The certificate files must be in base64. @@ -123,6 +122,14 @@ docker run -d --restart=unless-stopped \ rancher/rancher:latest ``` +By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. + +**To Remove the Default Certificates:** + +1. Log into Rancher. +2. Select **Settings** > **cacerts**. +3. Choose `Edit` and remove the contents. Then click `Save`. + ### Option D-Let's Encrypt Certificate Rancher supports Let's Encrypt certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.