SAN Names for Ingress listener - Kafka listener certificates

[Sai-Charan-Madhvaraj]

Hi Team,

I am using our own certificates for only external listener (type INGRESS), But in the documentation https://strimzi.io/docs/operators/0.27.1/using.html#ref-alternative-subjects-certs-for-listeners-str , its mentioned to add wild card SAN which has SVC.CLUSTER.LOCAL .

Do we really need to add all the SAN Entries of SVC.CLUSTER.LOCAL for external listener ? as we think services are only for internal communications.

[scholzj]

No, it is not. Basically, this: https://strimzi.io/docs/operators/0.27.1/using.html#tls_listener_san_examples ... applies for internal listeners. And this: https://strimzi.io/docs/operators/0.27.1/using.html#external_listener_san_examples for external listeners. It does not mention ingress, but for Ingress type listener you basically need to add the Ingress addresses you will be using as the SANs.

[Sai-Charan-Madhvaraj]

Perfect,thank you so much.