Skip to content

Commit 3008189

Browse files
prithvipatil97Prithviraj Patil
authored andcommitted
[OSDOCS-15293] Update nw-mutual-tls-auth.adoc
- Wrong command structure in Configuring mutual TLS authentication Here is the current look: Procedure 1. In the openshift-config namespace, create a config map from your CA bundle: $ oc create configmap \ router-ca-certs-default \ --from-file=ca-bundle.pem=client-ca.crt \ 1 -n openshift-config 4. Optional, get the Distinguished Name (DN) for allowedSubjectPatterns by entering the following command. $ openssl x509 -in custom-cert.pem -noout -subject subject= /CN=example.com/ST=NC/C=US/O=Security/OU=OpenShift The above commands are not structured properly. We can use the above command as well, and it will execute perfectly. But its structure is not as per our standard procedure. Hence, it needs to be changed. Here is the updated look: 1. In the openshift-config namespace, create a config map from your CA bundle: $ oc create configmap \ router-ca-certs-default \ --from-file=ca-bundle.pem=client-ca.crt \ 1 -n openshift-config 4. Optional, get the Distinguished Name (DN) for allowedSubjectPatterns by entering the following command. $ openssl x509 -in custom-cert.pem -noout -subject subject= /CN=example.com/ST=NC/C=US/O=Security/OU=OpenShift [new-commit]Update nw-mutual-tls-auth.adoc [new-commit]Update nw-mutual-tls-auth.adoc
1 parent 7c266f7 commit 3008189

File tree

1 file changed

+12
-5
lines changed

1 file changed

+12
-5
lines changed

modules/nw-mutual-tls-auth.adoc

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ If the `clientCA` value specifies an X509v3 certificate revocation list (CRL) di
3030
[source,terminal]
3131
----
3232
$ oc create configmap \
33-
router-ca-certs-default \
34-
--from-file=ca-bundle.pem=client-ca.crt \// <1>
35-
-n openshift-config
33+
router-ca-certs-default \
34+
--from-file=ca-bundle.pem=client-ca.crt \// <1>
35+
-n openshift-config
3636
----
3737
<1> The config map data key must be `ca-bundle.pem`, and the data value must be a CA certificate in PEM format.
3838

@@ -61,9 +61,16 @@ $ oc edit IngressController default -n openshift-ingress-operator
6161
allowedSubjectPatterns:
6262
- "^/CN=example.com/ST=NC/C=US/O=Security/OU=OpenShift$"
6363
----
64+
6465
. Optional, get the Distinguished Name (DN) for `allowedSubjectPatterns` by entering the following command.
66+
+
6567
[source,terminal]
6668
----
67-
$ openssl x509 -in custom-cert.pem -noout -subject
68-
subject= /CN=example.com/ST=NC/C=US/O=Security/OU=OpenShift
69+
$ openssl x509 -in custom-cert.pem -noout -subject
70+
----
71+
+
72+
.Example output
73+
[source,text]
74+
----
75+
subject=C=US, ST=NC, O=Security, OU=OpenShift, CN=example.com
6976
----

0 commit comments

Comments
 (0)