Breadcrumbs

Sign the Host Certificate Using ESKM

Review steps 5.1.1 to 5.1.4 in Configuration on Kubernetes Control Plane Node and ensure all the steps are completed before proceeding with the steps below.

  1. Copy the generated CSR to /home/admin/k8s_plugin/certs and submit it to ESKM for signing by the ESKMLocalCA as a client certificate, see Create a Client Certificate.

image-20250806-104541.png

Generated CSR in k8s_plugin

  1. Go to ESKM Management Console > Security > Certificates & CAs > Local CAs .

image (3).png

Local CA

  1. Select the created CA and click Sign Request.

image-20250806-104702.png

Sign Certificate Request

  1. Select the previously created CA certificate from the Sign with Certificate Authority dropdown list.

  2. Select Client in the Certificate Purpose section.

  3. Copy the host certificate content to the Certificate Request box.

  4. Copy the signed certificate and save it as kms_plugin_client.crt in the certs directory.

image (1).png

Signed Certificate Information

image-20250806-110956.png


kms_plugin_client.crt

  1. Copy the ESKMLocalCA certificate and save it as ESKMLocalCA.crt in the certs directory.

image (2).png

CA Certificate Information

image-20250806-111104.png


ESKMLocalCA.crt

  1. Ensure that all three filesESKMLocalCA.crt, kms_plugin_client.crt and kms_plugin_client.keyare present in the certs directory.

image-20250806-111132.png


certs Directory