Test certificate generation locally with ngrok and the ACME plugin
Use ngrok to create a domain, create a Service and Route that use your ngrok domain, and then enable the ACME plugin with config.domains
set to your ngrok host. Generate a certificate with curl https://$NGROK_HOST:8443 --resolve $NGROK_HOST:8443:127.0.0.1 -vk
.
Prerequisites
Kong Gateway running
This tutorial requires Kong Gateway Enterprise. If you don’t have Kong Gateway set up yet, you can use the quickstart script with an enterprise license to get an instance of Kong Gateway running almost instantly.
-
Export your license to an environment variable:
export KONG_LICENSE_DATA='LICENSE-CONTENTS-GO-HERE'
Copied to clipboard! -
Run the quickstart script:
curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA
Copied to clipboard!Once Kong Gateway is ready, you will see the following message:
Kong Gateway Ready
Configure a Service and Route
The ACME plugin requires a Route to access the proxy to trigger certificate generation.
Create a Gateway Service as well as a corresponding Route that points to your ngrok host:
echo '
_format_version: "3.0"
services:
- name: acme-test
url: https://httpbin.konghq.com
routes:
- name: acme-route
service:
name: acme-test
hosts:
- "${{ env "DECK_NGROK_HOST" }}"
' | deck gateway apply -
Enable the plugin
You can now enable the ACME plugin globally with ngrok as your domain:
echo '
_format_version: "3.0"
plugins:
- name: acme
config:
account_email: test@test.com
tos_accepted: true
domains:
- "${{ env "DECK_NGROK_HOST" }}"
storage: kong
' | deck gateway apply -
Create a certificate
Trigger certificate creation:
curl https://$DECK_NGROK_HOST:8443 --resolve $DECK_NGROK_HOST:8443:127.0.0.1 -vk
This might take a few seconds.
Validate
Validate that the certificate was correctly created:
echo q |openssl s_client -connect localhost -port 8443 -servername $DECK_NGROK_HOST 2>/dev/null |openssl x509 -text -noout
You should see the certificate in the output.
Cleanup
Destroy the Kong Gateway container
curl -Ls https://get.konghq.com/quickstart | bash -s -- -d