# Mongob Operator. corp ACME for public ssl cert, self signed for internalssl

**URL:** <https://forums.percona.com/t/mongob-operator-corp-acme-for-public-ssl-cert-self-signed-for-internalssl/37307>\
**Category:** Percona Operator for MongoDB\
**Created:** [March 21, 2025, 2:21pm UTC](https://forums.percona.com/t/mongob-operator-corp-acme-for-public-ssl-cert-self-signed-for-internalssl/37307 "2025-03-21T14:21:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pierre\_OBLIN](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/pierre_oblin/32/15213_2.png) [@Pierre\_OBLIN](https://forums.percona.com/u/Pierre_OBLIN)\
**Post date:** [March 21, 2025, 2:21pm UTC](https://forums.percona.com/t/mongob-operator-corp-acme-for-public-ssl-cert-self-signed-for-internalssl/37307/1 "2025-03-21T14:21:48Z")

</div>

## Description:

Im creating a psmdb.  
I wanted to leverage certmanager corporate ACME to get a valid public PKI

## Steps to Reproduce:

Define Certificate for public cert

```auto
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: mongodb-instance-public-tls
spec:
  issuerRef:
    name: intranet-ca
    kind: ClusterIssuer
 #secretName: psm-db-psmdb-db-ssl #Secret name mut be (my-cluster-name-ssl)
  secretName: mongodb-instance-public-tls
  
  #one alternate name per LoadBalancer service
  dnsNames:
  - rs0-0-xxx
  - rs0-1-xxx
  - rs0-2-xxx

```

Define Certificate for private cert

```auto
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: manual-psm-db-psmdb-db-ssl-internal
spec:
  commonName: psm-db-psmdb-db-rs0
  dnsNames:
  - localhost
  #adding internal alt name (ACME compatible ? )
  - psm-db-psmdb-db-rs0
  - psm-db-psmdb-db-rs0.${namespace}
  - psm-db-psmdb-db-rs0.${namespace}.svc.cluster.local
  - "*.psm-db-psmdb-db-rs0"
  - "*.psm-db-psmdb-db-rs0.${namespace}"
  - "*.psm-db-psmdb-db-rs0.${namespace}.svc.cluster.local"  

  - psm-db-psmdb-db-mongos
  - psm-db-psmdb-db-mongos.${namespace}
  - psm-db-psmdb-db-mongos.${namespace}.svc.cluster.local
  - '*.psm-db-psmdb-db-mongos'
  - '*.psm-db-psmdb-db-mongos.${namespace}'
  - '*.psm-db-psmdb-db-mongos.${namespace}.svc.cluster.local'

  - psm-db-psmdb-db-cfg
  - psm-db-psmdb-db-cfg.${namespace}
  - psm-db-psmdb-db-cfg.${namespace}.svc.cluster.local
  - '*.psm-db-psmdb-db-cfg'
  - '*.psm-db-psmdb-db-cfg.${namespace}'
  - '*.psm-db-psmdb-db-cfg.${namespace}.svc.cluster.local'
  - psm-db-psmdb-db-mongos.${namespace}.svc.clusterset.local
  - '*.psm-db-psmdb-db-mongos.${namespace}.svc.clusterset.local'
  - psm-db-psmdb-db-cfg.${namespace}.svc.clusterset.local
  - '*.psm-db-psmdb-db-cfg.${namespace}.svc.clusterset.local'
  duration: 2160h0m0s
  issuerRef:
    kind: Issuer
    name: manual-psm-db-psmdb-db-psmdb-issuer
  secretName: manual-psm-db-psmdb-db-ssl-internal
  subject:
    organizations:
    - PSMDB

```

Setup generated Secrets in the PSMDB

```auto
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: psm-db
spec:
  values:
...
    tls:
      #https://docs.percona.com/percona-operator-for-mongodb/TLS.html
      mode: preferTLS # turns on TLS for internal communication, and allows both TLS and non-TLS external traffic
     #mode: requireTLS #enforces the use of TLS encrypted connections only,
      allowInvalidCertificates: true #If true, the mongo shell will not attempt to validate the server certificates. Should be true (default variant) to use self-signed certificates generated by the Operator when there is no cert-manager.
    
    secrets:
      ssl: mongodb-instance-public-tls-with-ca #A secret with TLS certificate generated for external communications + tls.ca
      sslInternal: internal-cert-with-ca # same as manual-psm-db-psmdb-db-ssl-internal + tls.ca  

```

## Version:

operator 1.19.1

## Logs:

```auto

```

## Expected Result:

Id expect internal cert to be used for internal traffic.  
I dont expect my public cert to be used for internal traffic

## Actual Result:

Seems the public tls is used for internal traffic. Forcing me to add alt SAN on my public cert (which is not possible with corp ACME)

mongodb pod failure log

```auto
Autoscroll:Off FullScreen:On Timestamps:Off Wrap:Off mongod {"t":{"$date":"2025-03-21T13:47:21.897+00:00"},"s":"W", "c":"NETWORK", "id":23238, "ctx":"ReplicaSetMonitor-TaskExecutor","msg":"The server certificate does not match the remote host name","attr":{"remoteHost":"psm-db-psmdb-db-rs0-0.psm-db-psmdb-db-rs0.mongodbaas-xplane-662b4aad-d123-4014-939e-b298f51b6b98.svc.cluster.local","certificateNames":"SAN(s): rs0-0-662b4aad-d123-4014-939e-b298f51b6b98.xxxxx, rs0-1-662b4aad-d123-4014-939e-b298f51b6b98.xxxxxx, rs0-2-662b4aad-d123-4014-939e-b298f51b6b98.xxxxxxx, CN: rs0-0-662b4aad-d123-4014-939e-b298f51b6b98.xxxxxxx"}}  

```

## Additional Information:

[Include any additional information that could be helpful to diagnose the issue, such as browser or device information]