# Create Let’s Encrypt certificate

> [HTML Version](certificate-lets-encrypt.html)

Let’s Encrypt is a free, automated, and open Certificate Authority. It helps solve the problem of automatic HTTPS configuration on a server, where SSL/TLS certificates are issued and renewed without human participation.

You can install Let’s Encrypt certificate in BRIX On-Premises. Let's look at how to perform such installation.

To create a Let’s Encrypt certificate, follow these steps:

1. Install the [Cert-manager](install-cert-manager.md) add-on component.

2. Create the file **cluster-issuer.yaml**:

````
nano cluster-issuer.yaml

````
To initiate the certificate order procedure in a Kubernetes cluster, certification authority (CA) resources that are used to sign Certificate Signing Requests (CSRs) must be declared. Depending on the desired scope, you can declare the appropriate resource:

- **Issuer**: Can be used within a single namespace.

- **ClusterIssuer**: Is a global cluster-wide object.

3. Insert the following values into the **cluster-issuer.yaml** file:

````
apiVersion: cert-manager.io/v1  
kind: ClusterIssuer  
metadata:  
  name: brix365-certificate  
spec:  
  acme:  
    email: your\_email@mail\_server\_domain  
    server: https://acme-v02.api.letsencrypt.org/directory  
    privateKeySecretRef:  
      name: brix365-certificate  
    solvers:  
      - http01:  
          ingress:  
            class: nginx

````
Where:

- \[OBJECT\] is your email address.

- \[OBJECT\] is the server address. Let’s Encrypt has a limitation on the number of issued certificates, approximately five per week. For debugging purposes, you can use the server address of another issuer without limitations: \[OBJECT\].

4. Apply the **cluster-issuer.yaml** file to the cluster:

````
kubectl apply -f cluster-issuer.yaml

5. ````
Create a yaml-file for certificate **create-brix365-certificate.yaml**:

````
nano create-brix365-certificate.yaml

6. ````
 Modify the file **create-brix365-certificate.yaml**:

````
apiVersion: cert-manager.io/v1  
kind: Certificate  
metadata:  
  name: brix365-tls-certificate  
  namespace: \[namespace\]  
spec:  
  secretName: brix365-onpremise-tls  
  issuerRef:  
    kind: ClusterIssuer  
    name: brix365-certificate  
  commonName: brix365\_server.your\_domain  
  dnsNames:  
  - brix365\_server.your\_domain

````
Where:

- \[OBJECT\] is the name of the target namespace where the certificate should be placed.

- \[OBJECT\] and \[OBJECT\] are the fully qualified domain name (FQDN) for which the certificate should be issued (replace \[OBJECT\]).

````
начало примечание

````
**Note**

The secret with the certificate must be created in the same namespace in which the target application is running or will be installed, for which the certificate is being issued.

For the [BRIX](installing-elma365-enterprise.md) application, the standard namespace is \[OBJECT\]. 

For [embedded databases](embedded-databases-settings.md) the standard namespace is \[OBJECT\].

````
конец примечание

7. ````
 Apply the certificate to the cluster:

````
kubectl apply -f create-brix365-certificate.yaml

8. ````
To install or update the [BRIX](installing-elma365-enterprise.md) application or [embedded databases](embedded-databases-settings.md) use the secret \[OBJECT\] (the name specified in the parameter \[OBJECT\]).