How to enable managed HTTPS certificates in an existing cluster #

A managed certificate ensures you can securely access your Nimbra Edge installation without manually managing certificates.

This how-to assumes you have an existing cluster and would like to enable managed certificates. It applies to Kubernetes installations made with the Nimbra Edge installer; on Edge Core, enable managed certificates in the appliance’s web interface instead.

Otherwise, if you do not have a cluster, simply use the --managed-cert and --cert-email flags when running the installer.

Prerequisites #

In order to enable managed certificates, the Nimbra Edge installation needs to be reachable from the internet. Specifically port 80 and 443 need to be accessible. The Edge URL must use a domain name that resolves in public DNS to the installation, and the cluster needs outbound HTTPS access to Let’s Encrypt.

Unless cert-manager issued it, the installer deletes the certificate the installation uses now, including a certificate uploaded in Network Manager under Global settings. HTTPS connections can fail until Let’s Encrypt has issued the new certificate.

Enabling managed certificates #

Start by fetching the installer for the current version of your Nimbra Edge installation. If it is not R4.2.0, set VERSION to that version.

VERSION=R4.2.0
docker run --rm -v $PWD:/tmp/cwd docker.io/netiedge/installer:$VERSION \
    bash -c "cp -p /usr/src/edge/installer/edge /tmp/cwd/edge-$VERSION"

Then run the upgrade subcommand, for example:

./edge-$VERSION upgrade \
    --edge-url https://edge.example.com \
    --edge-user admin \
    --edge-password hunter2 \
    --kubernetes-provider metal \
    --cert-email admin@example.com \
    --managed-cert

After a short while the certificate should be updated, you can follow the progress with kubectl(1):

kubectl describe certificate edge-tls-certificate -n edge

After the certificate has been correctly provisioned its Ready condition should be True.

The upgrade waits up to five minutes for the certificate. From R4.2, it fails with Timed out waiting for certificate edge-tls-certificate to become ready if the certificate is not ready by then; check the prerequisites and run the upgrade again.

Add --managed-cert and --cert-email to every later upgrade of the installation. This is essential when upgrading from R4.1 to R4.2, which replaces ingress-nginx with Envoy Gateway: without them, nothing renews the certificate and it expires.