Kubernetes: cert-manager with FairSSL ACME

Setup

The guide assumes cert-manager is already installed in the cluster (Helm chart or static manifest). If not, follow the cert-manager installation first. Use v1.18 or later for ARI support.

Step 1: Create the EAB secret

Grab the EAB KID and HMAC key from the ACME tab in your FairSSL control panel and create a Kubernetes Secret in the cert-manager namespace.

kubectl create secret generic fairssl-eab-secret \
  --namespace cert-manager \
  --from-literal=secret=YOUR_EAB_HMAC

Step 2: Create the ClusterIssuer

ClusterIssuer is reachable from every namespace. Save as fairssl-issuer.yaml and apply.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: fairssl-acme-issuer
spec:
  acme:
    email: acme-client@fairssl.dk
    server: https://fairssl.dk/acme
    privateKeySecretRef:
      name: fairssl-acme-account-key
    externalAccountBinding:
      keyID: YOUR_EAB_KID
      keySecretRef:
        name: fairssl-eab-secret
        key: secret
    solvers:
    - http01:
        ingress:
          ingressClassName: nginx

kubectl apply -f fairssl-issuer.yaml

Step 3: Configure FairSSL AutoDNS

Make sure every domain you request a certificate for has a CNAME for _dnsauth.<domain> pointing at the FairSSL DNS server in the AutoDNS menu. One-time setup per domain. Even though we use the HTTP-01 solver in Kubernetes, AutoDNS ensures renewals keep working without manual intervention if the Ingress path is temporarily unreachable.

Step 4: Request a certificate

Create a Certificate object that references the ClusterIssuer. cert-manager creates a TLS Secret with the name in secretName automatically, which your Deployments and Ingresses can use.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: www-example-com
  namespace: default
spec:
  secretName: www-example-com-tls
  issuerRef:
    name: fairssl-acme-issuer
    kind: ClusterIssuer
  commonName: www.example.com
  dnsNames:
  - www.example.com
  - example.com

Step 5: Verify and debug

kubectl describe clusterissuer fairssl-acme-issuer
kubectl get certificate www-example-com -n default
kubectl describe certificate www-example-com -n default
kubectl get challenges -A

When the status reads Ready: True, www-example-com-tls holds the certificate and private key, ready to be mounted by your Deployment or referenced by an Ingress. Verify the public certificate with FairSSL\'s SSL scanner.