This is an internal documentation. There is a good chance you’re looking for something else. See Disclaimer.

Hostnames

Show Ingresses

$ oc get ingress
NAME                       CLASS    HOSTS                 ADDRESS                                  PORTS     AGE
nice                       <none>   tocco.tocco.ch        router-default.apps.openshift.tocco.ch   80, 443   100d
nice-backoffice.tocco.ch   <none>   backoffice.tocco.ch   router-default.apps.openshift.tocco.ch   80, 443   100d
nice-cockpit.tocco.ch      <none>   cockpit.tocco.ch      router-default.apps.openshift.tocco.ch   80, 443   100d
nice-extranet.tocco.ch     <none>   extranet.tocco.ch     router-default.apps.openshift.tocco.ch   80, 443   100d
nice-tocco.ch              <none>   tocco.ch              router-default.apps.openshift.tocco.ch   80, 443   100d
nice-www.tocco.ch          <none>   www.tocco.ch          router-default.apps.openshift.tocco.ch   80, 443   100d

SSL Certificates

Issuance

Deprecated

This is deprecated for use with Tocco but may still be used to enable SSL for other applications.

To setup SSL for Tocco see Add Route / Endpoint.

SSL certificates are issued automatically for ingresses with an appropriate annotation.

Configure DNS (Nice)
Obtain the name of the ingress (${INGRESS}):
```
oc get ingress
```

Add the annotation:

oc annotate ingress/${INGRESS} cert-manager.io/cluster-issuer=letsencrypt-production     cert-manager.io/private-key-rotation-policy=Always

Troubleshooting

Hint

Expect certificate issuance to take up to 15 minutes.

Check for missing TLS certificates in the OpenShift project:

$ oc project nice-${INSTALLATION}
$ oc get certificates
NAME                      READY   SECRET                    AGE
tls-backoffice.tocco.ch   True    tls-backoffice.tocco.ch   100d
tls-cockpit.tocco.ch      True    tls-cockpit.tocco.ch      100d
tls-extranet.tocco.ch     True    tls-extranet.tocco.ch     100d
tls-tocco.ch              True    tls-tocco.ch              100d
tls-tocco.tocco.ch        True    tls-tocco.tocco.ch        100d
tls-www.tocco.ch          True    tls-www.tocco.ch          100d

Note the READY column.

Show issuance details:

$ oc get certificate ${CERTIFICATE_NAME}
…
Status:
  Conditions:
    Last Transition Time:  2022-07-22T05:24:39Z
    Message:               Certificate is up to date and has not expired
    Observed Generation:   2
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2022-10-20T04:24:37Z
  Not Before:              2022-07-22T04:24:38Z
  Renewal Time:            2022-09-20T04:24:37Z
  Revision:                1
Events:
  Type    Reason     Age   From                                       Message
  ----    ------     ----  ----                                       -------
  Normal  Issuing    137m  cert-manager-certificates-trigger          Issuing certificate as Secret does not exist
  Normal  Generated  137m  cert-manager-certificates-key-manager      Stored new private key in temporary Secret resource "tls-toccotestnew.tocco.ch-hm7xq"
  Normal  Requested  137m  cert-manager-certificates-request-manager  Created new CertificateRequest resource "tls-toccotestnew.tocco.ch-cmz68"
  Normal  Issuing    137m  cert-manager-certificates-issuing          The certificate has been successfully issued

Issuance status and possible issues should be listed in the Status/Events sections.