Bug 1382599

Document URL: https://access.redhat.com/documentation/en/openshift-container-platform/3.3/single/installation-and-configuration/#registry-console

Section Number and Name:  3.2.6.2. Securing the Registry Console

Describe the issue: 	

What problem/issue/behavior are you having trouble with?  What do you expect to see?

when following https://docs.openshift.com/container-platform/3.3/install_config/registry/deploy_registry_existing_clusters.html#registry-console to secure the registry console, it tells me to :

oc secrets new console-secret \
    /path/to/console.crt \
    /path/to/console.key

however, once you've configured that secret as a volume in the deploymentconfig for the registry-console, and the pod is running, it will not load those certificates, because as your documentation clearly states (and is copy/pasted from the cockpit documentation itself) :


The registry console loads a certificate from the /etc/cockpit/ws-certs.d directory. It uses the last file with a .cert extension in alphabetical order. The .cert file should contain at least two OpenSSL style PEM blocks:

so, the .crt and .key files are not read and it continues to generate a self signed certificate and run with that.


Suggestions for improvement: The fix, is to combine SSL key and signed certificate into a .cert file, and create the secrets as follows :

oc secrets new console-secret /path/to/your.cert


Additional information: