Adding a custom CA certificate

Last published : Jun 12, 2026
The following steps inform you how to add a custom CA certificate by using the cfssl tool. The steps are about a KubernetesCA certificate.
Note: As an Administrator, you can use any other compliant tool for signing. Refer to the procedure of that tool. Ensure that you set"is_ca"totrue.
As a prerequisite, download the following packages from github.com repository by using python-pip.
Tools
  • cfssl
  • cfssl-certinfo
  • cfssljson
If you are using external CA credentials, skip steps 1 to 6 and go to step 7. Ensure that you set "is_ca" to true.
Complete the following steps
  1. On the bastion node, create a directory - custom-ca. Navigate to this directory to perform the next steps.
  2. Copy the following content into a file and save it as vxconfig.json.
    {
      "signing": {
        "default": {
          "expiry": "43800h"
        },
        "profiles": {
          "cluster": {
            "expiry": "8760h",
            "usages": [
              "signing",
              "key encipherment",
              "cert sign",
              "server auth",
              "client auth"
            ],
            "ca_constraint": {
              "is_ca": true
            }
          }
        }
      }
    }
    1. Copy the following content into a file and save it as csr_config.json.
    {
      "CN": "infoscale-ca",
      "key": {
        "algo": "rsa",
        "size": 2048
      },
      "hosts": [
        "kubernetes"
      ],
      "names": [
        {
          "O": "system:nodes",
          "OU": "vx"
        }
      ]
    }
  3. Run the following command to generate certificates.
cfssl genkey csr_config.json | cfssljson -bare infoscale-ca
Review output similar to the following output
2022/02/10 15:09:27 [INFO] generate received request
2022/02/10 15:09:27 [INFO] received CSR
2022/02/10 15:09:27 [INFO] generating key: rsa-2048
2022/02/10 15:09:28 [INFO] encoded CSR
  1. Now you must sign the certificate you just generated. Run the following command.
cfssl sign -ca /etc/kubernetes/pki/ca.crt -ca-key /etc/kubernetes/pki/ca.key -hostname kubernetes -config ./vxconfig.json -profile cluster ./infoscale-ca.csr | cfssljson -bare infoscale-ca
  1. Run ls to list files in the folder.
Following files must be created
infoscale-ca.csr  infoscale-ca-key.pem  infoscale-ca.pem
Here , infoscale-ca.pem is the external CA certificate.
  1. Copy the following content into a file and save it as custom-ca.yaml.
    apiVersion: v1
    kind: Namespace
    metadata:
      labels:
        control-plane: infoscale-sds-operator
      name: infoscale-vtas
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: infoscale-ca
      namespace: <namespace of cert-manager>
    type: kubernetes.io/tls
    data:
      ca.crt: $(oc get cm kube-root-ca.crt -o
                jsonpath="{.data['ca\.crt']}"| base64 -w0)
      tls.crt: $(base64 ./infoscale-ca.pem | tr -d '\n')
      tls.key: $(base64 ./infoscale-ca-key.pem | tr -d '\n')
    You have to replace content for ca.crt, tls.crt, and tls.key.
    1. Run
    oc get cm kube-root-ca.crt -o jsonpath="{.data['ca\.crt']}" | base64 -w0
    Copy the output of this command as
    \<Content of ca.crt\>
  2. Modify custom-ca.yaml as under
    apiVersion: v1
    kind: Namespace
    metadata:
      labels:
        control-plane: infoscale-sds-operator
      name: infoscale-vtas
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: infoscale-ca
      namespace: <namespace of cert-manager>
    type: kubernetes.io/tls
    data:
      ca.crt: <Content of ca.crt>
      tls.crt: $(base64 ./infoscale-ca.pem | tr -d '\n')
      tls.key: $(base64 ./infoscale-ca-key.pem | tr -d '\n')
    1. Similarly, run
    base64 ./infoscale-ca.pem | tr -d '\n' and update tls.crt in custom-ca.yaml with the output of this command.
    1. Run
    base64 ./infoscale-ca-key.pem | tr -d '\n' and update tls.key in custom-ca.yaml with the output of this command.
    1. Ensure that custom-ca.yaml is as under
    apiVersion: v1
    kind: Namespace
    metadata:
      labels:
        control-plane: infoscale-sds-operator
      name: \<cert-manager namespace\>
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: infoscale-ca
      namespace: \<namespace of cert-manager\>
    type: kubernetes.io/tls
    data:
      ca.crt: \<Content of ca.crt\>
      tls.crt: \<Content of tls.crt\>
      tls.key: \<Content of tls.key\>
  3. Run oc apply -f custom-ca.yaml.
  4. If you are configuring DR, copy this custom-ca.yaml to the DR cluster.
  5. Run oc apply -f custom-ca.yaml on the DR cluster before applying license.
After custom-ca.yaml is successfully applied, you can apply iso.yaml. See the Installation section.
Note: This certificate is valid for 12 months. Ensure that you extend its validity in the eighth month.