# Create SSL certificates for TLS/SSL using Cert-manager

> [HTML Version](ssl-certificates-with-cert-manager.html)

A self-signed SSL certificate is used for dynamic test environments or when using an external load balancer that terminates SSL traffic.

````
начало внимание

````
A self-signed SSL certificate does not provide robust data protection against malicious actors. It is recommended to use commercial SSL certificates from trusted certificate authorities such as Comodo, Symantec, Thawte, etc.

````
конец внимание

````
To create a certificate with the SAN attribute, follow these steps:

1. Install [Cert-manager](install-cert-manager.md) add-on component.

2. Create yaml-file **selfsigned-cluster-issuer.yaml**:

````
nano selfsigned-cluster-issuer.yaml

````
To initiate the certificate issuance procedure in a Kubernetes cluster, certification authority (CA) resources must be declared. These resources are used to sign Certificate Signing Requests (CSRs) for issuing certificates. Depending on the required scope, you can declare the following resources:

- **Issuer** can be used in one namespace.

- **ClusterIssuer** is the cluster’s global object.

3. In the **selfsigned-cluster-issuer.yaml** file, insert the following values:

````
apiVersion: cert-manager.io/v1  
kind: ClusterIssuer  
metadata:  
  name: brix365-selfsigned-certificate  
spec:  
  selfSigned: \{\}

4. ````
Apply the **selfsigned-cluster-issuer.yaml** file to the cluster:

````
kubectl apply -f selfsigned-cluster-issuer.yaml

5. ````
Create a yaml-file for the certificate **create-selfsigned-brix365-certificate.yaml**:

````
nano create-selfsigned-brix365-certificate.yaml

6. ````
Modify the file **create-selfsigned-brix365-certificate.yaml**:

````
apiVersion: cert-manager.io/v1  
kind: Certificate  
metadata:  
  name: brix365-selfsigned-tls-certificate  
  namespace: \[namespace\]  
spec:  
  secretName: brix365-onpremise-tls  
  secretTemplate:  
    annotations:  
      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"  
      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "kube-system"  
      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"  
      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "kube-system"  
  duration: 8760h  
  renewBefore: 720h  
  isCA: false  
  subject:  
    organizations:  
    - "YOUR\_NAME\_ORGANIZATIONS"  
  privateKey:  
    algorithm: ECDSA  
    size: 384  
    encoding: PKCS8  
    rotationPolicy: Always  
  issuerRef:  
    kind: ClusterIssuer  
    name: brix365-selfsigned-certificate  
  commonName: "brix365\_server.your\_domain"  
  dnsNames:  
  - "brix365\_server.your\_domain"

````
Where:

- \[OBJECT\] is the name of the target namespace where the certificate should be placed.

````
начало примечание

````
**Note**

The secret with the certificate must be created in the same namespace in which the target application is running or will be installed, for which the certificate is being issued.

For the [BRIX](installing-elma365-enterprise.md) application, the standard namespace is \[OBJECT\].

For [embedded databases](embedded-databases-settings.md) the standard namespace is \[OBJECT\].

````
конец примечание

- ````
\[OBJECT\] is the validity period of the certificate in hours.

- \[OBJECT\]** **is the name of your company (replace \[OBJECT\]).

- \[OBJECT\] and \[OBJECT\] is the fully qualified domain name (FQDN) for which the certificate should be issued (replace \[OBJECT\]).

7. Apply the **create-selfsigned-brix365-certificate.yaml** file to the cluster:

````
kubectl apply -f create-selfsigned-brix365-certificate.yaml

8. ````
To install and update [BRIX](installing-elma365-enterprise.md) or the [embedded databases](embedded-databases-settings.md) use the secret \[OBJECT\] (the name specified in the parameter \[OBJECT\]).