Configure Customer Certificates for Tenable Enclave Security

Use this procedure to configure your own TLS certificates for Tenable Enclave Security instead of the auto-generated defaults.

Before you begin

• You must have a private key (.key file) and a signed certificate from your CA (.crt or .pem file).

• The certificate must include Subject Alternative Names (SAN) matching your Tenable Enclave Security domain (for example, *.yourdomain.com).

• You must have access to the Tenable Enclave Security Kubernetes namespace.

To configure customer certificates for Tenable Enclave Security:

1. Run the following command to create a Kubernetes secret with your certificate and key:

   Copy

   kubectl create secret tls <secret-name> \
     --cert=customer.crt \
     --key=customer.key \
     -n <tes-namespace>

2. Update your Tenable Enclave Security site file or values.yaml override file:

   Copy

   tes:
     blades:
       traefik:
         certificates:
           external:
             enabled: false
             secretName: <secret-name>

3. Run the following command to deploy or update Tenable Enclave Security with the updated configuration:

   Copy

   helm upgrade tes-operator <chart-path> -n <namespace> -f <site-file>.yaml

4. Confirm that IngressRoutes are using your certificate:

   Copy

   kubectl get ingressroute -n <namespace> -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.tls.secretName}{"\n"}{end}'