How to setup self-signed intermediate certificates in Kong hybrid model

To install Kong in the hybrid model by Helm, the parameters below are typically required in the case of using self-signed intermediate certificates.

In CP config:

- name: KONG_CLUSTER_MTLS
  value: pki
- name: KONG_CLUSTER_CA_CERT
  value: {path-to-chain.cert}  # in case of using immediate CA
- name: KONG_CLUSTER_CERT
  value: {path-to-cert}
- name: KONG_CLUSTER_CERT_KEY
  value:  {path-to-key}

In DP config:

- name: KONG_CLUSTER_MTLS
  value: pki
- name: KONG_CLUSTER_CA_CERT
  value: {path-to-chain.cert}  # in case of using immediate CA
- name: KONG_CLUSTER_SERVER_NAME
  value: {CN}  # this should be matching with cp cert CN name
- name: KONG_CLUSTER_CERT
  value: {path to cert}
- name: KONG_CLUSTER_CERT_KEY
  value: {path to key}
- name: KONG_LUA_SSL_TRUSTED_CERTIFICATE
  value: {path-to-chain.cert}  # in case of using immediate CA
- name: KONG_CLUSTER_TELEMETRY_SERVER_NAME
  value: {same to KONG_CLUSTER_SERVER_NAME}

Troubleshooting:

1. Error message: telemetry, tls handshake failed: certificate host mismatch

   Solution:

   Please add KONG_CLUSTER_TELEMETRY_SERVER_NAME into the DP. The value should be the same as KONG_CLUSTER_SERVER_NAME.

2. Error message: unable to verify the first certificate

   This error message indicates an intermediate CA is used.

   In this case, a full chain from root CA to intermediate CA should be provided.

   For example, let’s call it chain.pem.

   Inside it would look like:

   -----BEGIN CERTIFICATE-----
   {root ca cert}
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
   {intermediate ca cert}
   -----END CERTIFICATE-----

   Copied!

   Then, make the value of KONG_CLUSTER_CA_CERT and KONG_LUA_SSL_TRUSTED_CERTIFICATE point to this chain.pem.