Cert-manager: Cert-manager - Failed to decode returned certificate

[sramek5]

I am trying to connect vault to our kubernetes cluster via vault-issuer. I am using Authenticating with Kubernetes Service Account and also PKI in Vault.

Describe the bug:
My vault-issuer status is ready and vault verified, but when I make Certificate, its CertificateRequest gives me error.

CertificateRequest is capable to get information from vault, it will get CSR and download ca and certificate.

It looks like that the problem is in the secret, because cert-manager makes secret which needs 4 data objects - ca.crt, rsa.key, tls.crt and tls.key and Vault sends only ca and certificate (which is actually base64 encoded rsa key + ca.crt).

Expected behaviour:
Vault should send a certificate which would be added inside a Secret (kubernetes object) binded to Certificate and related to Aplication..

Error:
DecodeError - Failed to decode returned certificate: error parsing TLS certificate: asn1: structure error: tags don't match (16 vs {class:0 tag:2 length:1 isCompound:false}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} tbsCertificate @2

Environment details:

• Kubernetes version (Client = v1.17.0; Server v1.13.12)
• Cloud-provider/provisioner (Cloudinfrastack)
• cert-manager version (v0.13.1)
• Install method (via helm=v3.0.0 repo)

My Vault-Issuer:

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: vault-issuer
  namespace: lucky
spec:
  vault:
    path: linca/issue/web-certs
    server: https://homeadress.com/
    caBundle: <base64 encoded Linca CA Bundle PEM file>
    auth:
      kubernetes:
        role: kubernetes-vault
        mountPath: /v1/auth/kubernetes
        secretRef:
          name: service-account-oken-8998p
          key: token

My Certificate:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: cert-test
  namespace: lucky
spec:
  secretName: vault-test
  duration: 180s 
  renewBefore: 100s
  isCA: false
  keyAlgorithm: rsa
  keySize: 2048
  keyEncoding: pkcs1
  dnsNames:
  - my.service.com
  commonName: my-service.com
  issuerRef:
    name: vault-issuer
    kind: Issuer

Can anyone please help me with this?
Also, why is not pkcs12 supported?

/kind bug

[munnerz]

The error you're seeing is due to configuring the incorrect endpoint to request certificates from in your Vault issuer. Note here: https://cert-manager.io/docs/configuration/vault/#deployment Path is the Vault path that will be used for signing. Note that the path must use the sign endpoint.

You should adjust the following in order to make it work:

spec:
  vault:
    path: linca/sign/web-certs

The error occurs because when using the issue endpoint, the Vault server will generate a private key, which we attempt to decode as an x509 certificate which obviously fails. cert-manager must be responsible for private key generation, so the sign endpoint is required :)

Also, why is not pkcs12 supported?

See https://github.com/jetstack/cert-manager/issues/586

[munnerz]

/area vault
/triage support
/remove-kind bug

[sramek5]

Hi, thank you for fast response!
I am kind a new in this, so sorry for this issue.

Well, it makes sense now, but I am still not sure, what is meant to be web-certs

And I got one more question, in vault-issuer should be base64 encoded Linca CA Bundle PEM file. Actually I have two possibilities to paste:
1) linca_ca.pem
2) linca_ca_chain.pem

Chain is quite longer and issuer looks that it does not care which one is used.

[munnerz]

Well, it makes sense now, but I am still not sure, what is meant to be web-certs

This guide seems like it was written a while ago, but contains some info on how to configure the PKI backend in Vault:

https://www.arctiq.ca/our-blog/2019/4/1/how-to-use-vault-pki-engine-for-dynamic-tls-certificates-on-gke/

You need to 'mount' a PKI backend into your Vault instance which will then be used to retrieve certificates 😄

And I got one more question, in vault-issuer should be base64 encoded Linca CA Bundle PEM file. Actually I have two possibilities to paste:

Using the chain is _usually_ the most appropriate, as this contains intermediate CAs that are used for validating the certificate the vault server presents. If either works though, then great 😄

Hope that helps! There's also the Slack channel over on slack.k8s.io (#cert-manager) if you're still running into problems!

[sramek5]

Well, I got it and it works! 😃

Thank you for your advices.

[LekeFasola]

Hello @munnerz, Im having the same error message here but my endpoint is pki-k8s-usercert/issue/nsv-leke-dev and not pki-k8s-usercert/sign/nsv-leke-dev

```
The certificate request has failed to complete and will be retried: Failed to decode returned certificate: error parsing TLS certificate: asn1: structure error: tags don't match (16 vs {class:0 tag:2 length:1 isCompound:false}) {optional:false explicit:false application:false private:false defaultValue: tag: stringType:0 timeType:0 set:false omitEmpty:false} tbsCertificate @2
Vault Issuer configfile::::
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
name: vault-issuer
namespace: cert-manager
spec:
# This describes the vault namespace, path,location, caBundle and authentication method
vault:
namespace: ngc
path: pki-k8s-usercert/issue/nsv-leke-dev
server: https://prod.vault.leke.com
caBundle: >
LS0tL*fssffd*
auth:
#Here, cert-manager will be using appRole to authenticate with the vault. This represent the userID for the authentication
appRole:
path: approle
# RoleID to athenticate with the vault
roleId: "c83*"
# A base64 encoded secret key which serve as the password for the approle. This secret is also created separately and its been referenced here
secretRef:
name: cm-vault-approle
key: secretId
My Certificate configfile
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
name: dev-leke-com-tls
namespace: cert-manager
spec:
# This is secret that specifies where the signed certificate should be stored when its obtained from the vault
secretName: leke-com
# this reference the Vault that will issue the certificate
issuerRef:
name: vault-issuer
kind: ClusterIssuer
group: cert-manager.io
# the dns of the cluster url
commonName: dev.leke.com
dnsNames:

• dev.leke.com