Certificates

5min
Certificates are required in the following scenarios:
Sign in and verify SAML Requests and Responses
Sign JSON Web Tokens for OAuth and OIDC
Connect to remote docker hosts using Docker integration
Verify LDAP server certificates
Encrypt outpost endpoints
Default Certificate
Kubeark Identity generates a self-signed certificate on the first start, which is valid for 1 year and can be used as a default for all OAuth2/OIDC providers. This certificate is also usable for SAML providers/sources, although it should be rotated regularly since some SAML applications require valid certificates. Kubeark allows users to generate a longer-validity certificate for SAML use-cases.
External certificates
Kubeark allows for the use of externally managed certificates through the discovery feature. For docker-compose installations, the /certs directory can be used as an output directory for certbot. For Kubernetes, custom secrets/volumes can be mapped under /certs. Single files can also be bind-mounted into the folder following a specific naming schema. Files in the root directory will be imported as certificate or private key based on their filename and contents. If the file is named fullchain.pem or privkey.pem, they will get the name of the parent folder. Files can have any arbitrary file structure and extension, but if the path contains "archive," the files will be ignored to better support certbot setups.
Text
certs/
├── baz
│   └── bar.baz
│       ├── fullchain.pem
│       └── privkey.pem
├── foo.bar
│   ├── fullchain.pem
│   └── privkey.pem
├── foo.key
└── foo.pem
certs/
├── baz
│   └── bar.baz
│       ├── fullchain.pem
│       └── privkey.pem
├── foo.bar
│   ├── fullchain.pem
│   └── privkey.pem
├── foo.key
└── foo.pem
﻿
Manual import
Certificates can also be imported manually. To do so, run the following command within the worker container
Text
ak import_certificate --certificate /certs/mycert.pem --private-key /certs/something.pem --name test
ak import_certificate --certificate /certs/mycert.pem --private-key /certs/something.pem --name test
﻿
Web Certificates
The default webserver certificate can be configured if you wish to create a very compact and self-contained install. 
Step 1: Encrypt certificates with this setup, using certbot, you can use this compose override (create or edit a file called docker-compose.override.yml in the same folder as the docker-compose file)
Text
version: "3.2"

services:
    certbot:
        image: certbot/dns-route53:v1.22.0
        volumes:
            - ./certs/:/etc/letsencrypt
        # Variables depending on DNS Plugin
        environment:
            AWS_ACCESS_KEY_ID: ...
        command:
            - certonly
            - --non-interactive
            - --agree-tos
            - -m your.email@company
            - -d authentik.company
            # Again, match with your provider
            - --dns-route53
version: "3.2"

services:
    certbot:
        image: certbot/dns-route53:v1.22.0
        volumes:
            - ./certs/:/etc/letsencrypt
        # Variables depending on DNS Plugin
        environment:
            AWS_ACCESS_KEY_ID: ...
        command:
            - certonly
            - --non-interactive
            - --agree-tos
            - -m your.email@company
            - -d authentik.company
            # Again, match with your provider
            - --dns-route53
﻿
Step 2: run docker-compose up -d, which will start certbot and generate your certificate. Within a few minutes, you'll see the certificate in your identity interface. (If the certificate does not appear, restart the worker container. This is caused by incompatible permissions set by certbot).
Applications
Flows