customize the cert's lifetime

[smile-kevinpan]

Hello, we are currently using the Gateway Provisioner method to create our Contour and Envoy objects. However, we would like to extend the default certificate duration for the automatically generated certificates, namely contourcert and envoycert.

We have reviewed the parameters in the ContourDeployment-related API documentation, but we couldn’t find any settings related to certificate duration. Is there a way to configure the certificate duration manually, or alternatively, can we use our own TLS certificates to create the contourcert and envoycert secret objects?

[tsaarni]

There was unfinished PR here with related discussion #6604. I think it would make lot of sense to have expiration configurable and even more so to allow using own certificates, but support for those is not there currently and I'm not aware of anyone working for that now.

[smile-kevinpan]

Thank you for your reply. We are still looking for a solution to the certificate expiration issue. If there are any updates or suggestions, please feel free to share. Thank you!

[nathanclayton]

This would be a great help, personally, I'd rather it be either the default certgen (like today), or just provide custom TLS secrets.

I have done that previously with the Contour Helm chart and had custom certs configured with cert-manager to generate new short-lived certificates every 24 hours (with a 48 hour expiration).