Generating TLS/HTTPS certificates

To satisfy modern browser requirements and provide a secure environment by default, you must generate certificates for TLS (Transport Layer Security) before you deploy the Sitecore containers. This ensures secure communication between the browser and the Kubernetes ingress controller.

The default Kubernetes ingress controller used by Sitecore XP is the NGINX Ingress Controller. The NGINX ingress controller is used to terminate TLS connections sent by the browser and proxy network traffic to the individual XP containers inside the cluster. For more information, see the Kubernetes documentation for ingress TLS configuration and NGINX TLS user guide.

The HTTPS protocol is required to support the secure browser cookies used by the Content Management and Identity Server roles. HTTPS is enabled by default on the Content Delivery role but you can disable it if it is not required for your specific use case.

The appendix Create the TLS/HTTPS certificates contains a sample script that generates the required certificates.

Once the self-signed root authority certificate and per-host TLS/SSL certificates have been generated, you must install the root authority certificate in the Trusted Root Certificate Authority store on all clients. The sample script uses the mkcert tool to automatically create the self-signed root authority certificate and install it in the correct certificate store.