Red Hat Advanced Cluster Security: Fixing the browser cert issue

When you do a generic set up of RHACS on OpenShift, there’s a unknown cert nag screen when trying to access the Central UI. SO ANNOYING! The OpenShift Router named Central is configured for passthrough TLS. That wont work. Let’s change it to reencrypt and use Central’s existing ca cert.

To remedy this, here’s a one-liner to update the termination type and update the destinationCACertificate with Central’s CA cert to the Central Router. You need to be logged in to your OpenShift cluster as cluster-admin.

oc apply -f - <<EOF 
apiVersion: route.openshift.io/v1 
kind: Route 
metadata: 
  name: central 
  namespace: stackrox 
spec: 
  tls: 
    termination: reencrypt
    destinationCACertificate: | 
      $(oc extract secret/central-tls -n stackrox --keys ca.pem --to=- | sed 's/^/ /' ) 
EOF

Find more awesome tools and patterns at the Stackrox community GitHub organization:

https://github.com/stackrox/contributions