Skip to main content
This guide demonstrates how to configure Istio to use a custom root certificate for your cluster. Follow the steps below to generate your own certificate authority (CA) and integrate it with Istio for enhanced security and trust in your service mesh.

​
Generating the Root Certificate

Begin by creating a directory for your certificates in the Istio root directory. In this example, we use “ca-certs”. Then navigate into the new directory:
Generate your root certificate by running the following command. This process creates four files:
  • root-ca.conf: OpenSSL configuration file used for generating the root certificate.
  • root-cert.csr: Certificate Signing Request (CSR) for the root certificate.
  • root-cert.pem: The root certificate.
  • root-key.pem: The private key associated with the root certificate.
A sample output may look like this:
Below is an alternative sample that shows all generated files:

​
Creating Intermediate Certificates

It is not recommended to use the root certificate directly for workload authentication. Instead, generate intermediate certificates to enhance security and ease certificate revocation.
Generate the intermediate certificates by running the following command. This creates an intermediate Certificate Authority (CA) for your cluster under the “localcluster” directory. The following files are produced:
  • cluster-ca.csr: CSR for the intermediate CA.
  • ca-cert.pem: Certificate for the intermediate CA.
  • ca-chain.pem: The full certificate chain.
Intermediate input and temporary files are stored in the localcluster directory and later cleaned up.
Sample output:

​
Preparing the Cluster for Custom Certificates

Before proceeding, remove any pre-installed Istio resources to avoid conflicts. Delete the Istio system namespace if it exists or start with a fresh cluster. For example:
Optionally, clean up the default namespace by navigating to the samples directory as needed:
Next, recreate the Istio system namespace and create a secret that stores all your generated certificates. For instance:
The cleanup script removes all related Bookinfo resources:

​
Installing Istio with Custom Certificates

Reinstall Istio so that the certificate authority loads the certificates and keys from the secret-mounted files. Run the following command:
You will see output confirming that Istio installs the core components, including Istiod, Ingress, and Egress gateways:
You can also deploy additional add-ons such as Kiali, Grafana, and Prometheus. For example:
If the path “samples/addons” does not exist in your current directory, navigate appropriately:
Optionally, deploy the Bookinfo application and apply default traffic rules:

​
Deploying a Policy for Mutual TLS

Enforce a policy so that workloads accept only mutual TLS traffic. Ensure the Bookinfo application is running before applying the policy. After about 15 seconds, verify that the workloads are using the specified certificates:
The sample output below might indicate a connection refusal, which is expected until the policies are fully in place:
You can check the status of all pods with:
Sample output when all pods are running:
If the command is run too early, you might see some pods still initializing:
Alternate sample output:

​
Verifying Certificate Chains

To further validate the configuration, retrieve and inspect the certificate chain from one of your applications (for example, the “details” application) by connecting to the “productpage” service. Because the CA certificate in this example is self-signed, you may see a warning indicating a “self-signed certificate in certificate chain”—this is expected. The certificate output (truncated for brevity) will appear similar to:
These certificates can be saved as separate files if necessary. Next, verify that the root certificate used by Istio matches your specified certificate. First, dump the certificate information from your generated root certificate:
Then, extract the certificate information from the workload traffic:
Compare the two files:
A message confirming identical files will look like:
Next, verify the entire certificate chain from the root to the workload certificate:
Successful verification outputs:
This confirms that Istio is signing workload certificates using your provided root certificate.
This guide has shown how to configure a custom certificate authority within Istio and verify its proper use in your service mesh. For more in-depth information, consider exploring additional resources on Istio Security and Kubernetes Security Best Practices.

Watch Video

Practice Lab