apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ldap
  namespace: openldap
spec:
  # Secret names are always required.
  secretName: openldap-tls

  duration: 2160h0m0s # 90d
  renewBefore: 360h0m0s # 15d
  subject:
    organizations:
      - undercloud
  # The use of the common name field has been deprecated since 2000 and is
  # discouraged from being used.
  commonName: ldap.undercloud.local
  #isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - server auth
    - client auth
  # At least one of a DNS Name, URI, or IP address is required.
  dnsNames:
    - ldap.undercloud.local
    #- ldap.openldap.svc.k8aux.undercloud.local
  #ipAddresses:
  #  - 192.168.0.5
  # Issuer references are always required.
  issuerRef:
    name: ca
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    # This is optional since cert-manager will default to this value however
    # if you are using an external issuer, change this to that issuer group.
    #group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: phpldapadmin
  namespace: openldap
spec:
  # Secret names are always required.
  secretName: phpldapadmin-tls

  duration: 2160h0m0s # 90d
  renewBefore: 360h0m0s # 15d
  subject:
    organizations:
      - undercloud
  commonName: phpldapadmin.openldap.svc.k8aux.undercloud.local
  #isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - server auth
    - client auth
  dnsNames:
    - phpldapadmin.openldap.svc.k8aux.undercloud.local
  issuerRef:
    name: ca
    kind: ClusterIssuer