Automating Wildcard SSL with cert-manager and RFC 2136

1

Create Kubernetes Secret for TSIG Key

kubectl create secret generic onlydns-tsig-secret \
  --namespace=cert-manager \
  --from-literal=tsig-secret="YOUR_BASE64_TSIG_SECRET_KEY"

2

Create ClusterIssuer Resource

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-onlydns-rfc2136
spec:
  acme:
    email: admin@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-account-private-key
    solvers:
    - dns01:
        rfc2136:
          nameserver: ns1.onlydns.com:53
          tsigKeyName: your-tsig-key-name
          tsigAlgorithm: HMACSHA256
          tsigSecretSecretRef:
            name: onlydns-tsig-secret
            key: tsig-secret

kubectl apply -f cluster-issuer.yaml

🔒 Least-Privilege Security Tip: In the OnlyDNS Portal or REST API, restrict this TSIG key to only update the _acme_challenge subdomain so cert-manager in Kubernetes cannot modify other DNS records.

3

Request Wildcard Certificate on Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-onlydns-rfc2136
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - "example.com"
    - "*.example.com"
    secretName: example-com-tls
  rules:
  - host: "app.example.com"
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80

kubectl apply -f ingress-wildcard.yaml
kubectl get certificate -w

🤖 Certbot Guide

Official EFF Certbot plugin

🐚 acme.sh Guide

Zero dependencies pure shell

⚡ Caddy Guide

Automatic HTTPS web server

🚦 Traefik Guide

Docker & microservice proxy