Test certificate generation locally with ngrok and the ACME plugin

Uses: Kong Gateway decK
Incompatible with
konnect
Related Resources
Minimum Version
Kong Gateway - 3.4
TL;DR

Use ngrok to create a domain, create a Service and Route that use your ngrok domain, and then enable the ACME plugin with config.domains set to your ngrok host. Generate a certificate with curl https://$NGROK_HOST:8443 --resolve $NGROK_HOST:8443:127.0.0.1 -vk.

Prerequisites

This tutorial requires Kong Gateway Enterprise. If you don’t have Kong Gateway set up yet, you can use the quickstart script with an enterprise license to get an instance of Kong Gateway running almost instantly.

  1. Export your license to an environment variable:

     export KONG_LICENSE_DATA='LICENSE-CONTENTS-GO-HERE'
    
    Copied to clipboard!
  2. Run the quickstart script:

     curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA 
    
    Copied to clipboard!

    Once Kong Gateway is ready, you will see the following message:

     Kong Gateway Ready
    

Configure a Service and Route

The ACME plugin requires a Route to access the proxy to trigger certificate generation.

Create a Gateway Service as well as a corresponding Route that points to your ngrok host:

echo '
_format_version: "3.0"
services:
  - name: acme-test
    url: https://httpbin.konghq.com
routes:
  - name: acme-route
    service:
      name: acme-test
    hosts:
    - "${{ env "DECK_NGROK_HOST" }}"
' | deck gateway apply -
Copied to clipboard!

Enable the plugin

You can now enable the ACME plugin globally with ngrok as your domain:

echo '
_format_version: "3.0"
plugins:
  - name: acme
    config:
      account_email: test@test.com
      tos_accepted: true
      domains:
      - "${{ env "DECK_NGROK_HOST" }}"
      storage: kong
' | deck gateway apply -
Copied to clipboard!

Create a certificate

Trigger certificate creation:

curl https://$DECK_NGROK_HOST:8443 --resolve $DECK_NGROK_HOST:8443:127.0.0.1 -vk
Copied to clipboard!

This might take a few seconds.

Validate

Validate that the certificate was correctly created:

echo q |openssl s_client -connect localhost -port 8443 -servername $DECK_NGROK_HOST 2>/dev/null |openssl x509 -text -noout
Copied to clipboard!

You should see the certificate in the output.

Cleanup

curl -Ls https://get.konghq.com/quickstart | bash -s -- -d
Copied to clipboard!

Did this doc help?

Something wrong?

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!