Zudoku
Cloud Platform

Certificates

When attaching a service to an instance, Unikraft Cloud exposes the instance on a subdomain of unikraft.app by default. It automatically issues a certificate for the domain from a public certificate authority.

Drive certificates from your own code

The SDKs wrap the certificate API, so renewals are a job your own code can run:

Code
await ukc.certificates.get(name="tls").update(chain=chain_pem, pkey=key_pem)

See the JavaScript, Python and Go SDKs.

Custom certificates

You can upload your own certificate to use with your services:

TerminalCode
unikraft certificates create --metro fra \
  --cn demo.unikraft.dev. \
  --name mydomain-cert \
  --pkey </path/to/private.key> \
  --chain </path/to/chain.pem>

Make sure that the common name given ends with a dot (.).

Unikraft Cloud checks both the CN and SAN fields of the certificate. The provided common name (CN) must match the one on the certificate file, and the certificate must be valid for the domain you want to use. It can also be a wildcard domain.

Use the CLI to view and manage certificates. For example, to list certificates:

TerminalCode
unikraft certificates list

You should see output like:

TerminalCode
METRO  NAME                COMMON-NAME        STATE  CREATED       NOT-AFTER
fra    mydomain-cert       demo.unikraft.dev  valid  1 minute ago  in 12 months
fra    mydomain.com-sa4x9  *.mydomain.com     valid  5 days ago    in 12 months

Retrieve full information about a certificate with:

TerminalCode
unikraft certificates get mydomain-cert

You should see output like:

TerminalCode
metro:         fra
name:          mydomain-cert
uuid:          9fabfc61-a168-439e-89e2-0d5308ee9f13
common-name:   demo.unikraft.dev
subject:       CN=demo.unikraft.dev
issuer:        CN=demo.unikraft.dev
serial-number: 43C149067F939CD41100A74905B80560C315E92F
state:         valid
timestamps:
  created:     just now
  not-before:  1 minute ago
  not-after:   in 12 months

Attaching certificates to services

You attach the certificate to a service group implicitly. You do this by creating an instance with a domain that matches the common name of the certificate:

TerminalCode
unikraft run --metro fra \
  -m 256M \
  -p 443:8080/http+tls \
  --domain demo.unikraft.dev \
  --image <my-org>/nginx:latest
TerminalCode
metro:           fra
name:            nginx-67zbu
uuid:            8a8bc1b9-0af6-420e-a426-190dc2da9eaa
state:           starting
image:           <my-org>/nginx
resources:
  memory:        256MiB
  vcpus:         1
service:
  uuid:          a942b9b5-ad17-3ffe-dcd2-ef4331f9087a
  name:          nameless-fog-0tvh1uov
  domains:
  - fqdn:        demo.unikraft.dev
    certificate:
      name:      mydomain-cert
      uuid:      9fabfc61-a168-439e-89e2-0d5308ee9f13
networks:
- uuid:          62d9bbf0-aec8-61f6-7bdb-86edf63dd068
  private-ip:    10.0.3.3
  mac:           12:b0:c6:23:ed:15
timestamps:
  created:       just now

To remove a certificate, first remove any instances from the relevant service and then remove the service. Remove the certificate with:

TerminalCode
unikraft certificates delete mydomain-cert

Learn more

Last modified on
DomainsVolumes