You can recognize the PEM format by the following traits:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
PEM Certificate Example:
----BEGIN CERTIFICATE----- MIIGVDCCBDygAwIBAgIJAMiIrEm29kRLMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNV ... more lines VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg== -----END CERTIFICATE-----
To encode your certificates in base64:
FILENAME
with the name of your certificate.
# MacOS cat FILENAME | base64 # Linux cat FILENAME | base64 -w0 # Windows certutil -encode FILENAME FILENAME.base64
The order of adding certificates is as follows:
-----BEGIN CERTIFICATE----- %YOUR_CERTIFICATE% -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- %YOUR_INTERMEDIATE_CERTIFICATE% -----END CERTIFICATE-----
You can validate the certificate chain by using the openssl
binary. If the output of the command (see the command example below) ends with Verify return code: 0 (ok)
, your certificate chain is valid. The ca.pem
file must be the same as you added to the rancher/rancher
container. When using a certificate signed by a recognized Certificate Authority, you can omit the -CAfile
parameter.
Command
openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443 ... Verify return code: 0 (ok)