Let’s Encrypt Integration

Let’s Encrypt is a certificate authority that provides free SSL/TLS certificates via an automated process. Their certificates are accepted by most of todays browsers.

APPUiO provides integration with Let’s Encrypt to automatically create, sign, install and renew certificates for your domains running on APPUiO.

To create a certificate for one of your domains follow these steps:

  1. If you haven’t already done so create a route for the fully qualified domain name (FQDN), e.g. www.example.org, your application should run under
  2. Add a CNAME record (important!) for the FQDN to the DNS of your domain pointing to cname.appuioapp.ch. E.g. in BIND: www  IN  CNAME  cname.appuioapp.ch. (the trailing dot is required)
  3. Annotate your route: oc -n MYNS annotate route ROUTE kubernetes.io/tls-acme=true

Creating certificates for the default domain appuioapp.ch is neither needed nor supported as APPUiO already has a wildcard certificate installed for *.appuioapp.ch. Without this wildcard certificate we would hit the Let’s Encrypt rate limits on the appuioapp.ch domain sooner or later.

Important: Always create a route before pointing a DNS entry to APPUiO and always remove the corresponding DNS entry before deleting a route for a domain of yours. Otherwise someone else could potentially create a route and a Let’s Encrypt certificate for your domain.

Please note:

  1. APPUiO automatically renews certificates a few days before they expire
  2. Let’s encrypt can only create domain validated certificates, i.e. it’s not possible to add an organization name to a Let’s Encrypt certificate.

Implementation details

APPUiO uses the OpenShift ACME controller to provide the Let’s Encrypt integration. We automated the installation using a Ansible Role ansible-role-openshift-acme which deploys the Docker Image.

The ACME account and the certificates are stored as secret in the corresponding project, that allows you to re-use these certificates for other applications running on APPUiO.