[Linux] 🔐 OpenSSL로 PFX 인증서 변환 후 Kubernetes TLS Secret 만들기

1openssl version
2# OpenSSL 3.0.x 이상 권장
3
4kubectl version --client

1PFX_FILE="example.com.pfx"
2PFX_PASS="ChangeMeStrongPass"   # PFX 원본 패스워드
3TMP_PASS="ChangeMeTempPass"     # 중간 작업용 임시 패스워드
4KEY_OUT="tls.key"
5CRT_OUT="fullchain.crt"
6NAMESPACE="argocd"
7SECRET_NAME="tls-example-com"

1openssl pkcs12 \
2  -passin pass:${PFX_PASS} \
3  -passout pass:${TMP_PASS} \
4  -in ${PFX_FILE} \
5  -nocerts \
6  -out tmp.key

1openssl rsa \
2  -passin pass:${TMP_PASS} \
3  -in tmp.key \
4  -out ${KEY_OUT}

1writing RSA key

1-----BEGIN RSA PRIVATE KEY-----
2MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQ...
3-----END RSA PRIVATE KEY-----

1openssl pkcs12 \
2  -passin pass:${PFX_PASS} \
3  -in ${PFX_FILE} \
4  -clcerts \
5  -nokeys \
6  -out ${CRT_OUT}

1openssl pkcs12 \
2  -passin pass:${PFX_PASS} \
3  -in ${PFX_FILE} \
4  -nokeys \
5  -out fullchain.crt

1openssl x509 -in ${CRT_OUT} -noout -subject -issuer -dates

1subject=CN=example.com
2issuer=CN=Internal Issuing CA
3notBefore=Jan  1 00:00:00 2026 GMT
4notAfter=Dec 31 23:59:59 2026 GMT

1diff \
2  <(openssl rsa -in ${KEY_OUT} -modulus -noout) \
3  <(openssl x509 -in ${CRT_OUT} -modulus -noout)

1kubectl create secret tls ${SECRET_NAME} \
2  -n ${NAMESPACE} \
3  --key ${KEY_OUT} \
4  --cert ${CRT_OUT} \
5  --dry-run=client -o yaml > tls-example-com.yaml

1apiVersion: v1
2kind: Secret
3metadata:
4  name: tls-example-com
5  namespace: argocd
6type: kubernetes.io/tls
7data:
8  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ...
9  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpN...

1kubectl apply -f tls-example-com.yaml
2
3kubectl get secret ${SECRET_NAME} -n ${NAMESPACE}
4# NAME              TYPE                DATA   AGE
5# tls-example-com   kubernetes.io/tls   2      5s

 1apiVersion: networking.k8s.io/v1
 2kind: Ingress
 3metadata:
 4  name: argocd-server-ingress
 5  namespace: argocd
 6spec:
 7  ingressClassName: nginx
 8  tls:
 9    - hosts:
10        - example.com
11      secretName: tls-example-com
12  rules:
13    - host: example.com
14      http:
15        paths:
16          - path: /
17            pathType: Prefix
18            backend:
19              service:
20                name: argocd-server
21                port:
22                  number: 443

1shred -u tmp.key ${KEY_OUT} 2>/dev/null || rm -f tmp.key ${KEY_OUT}

 1#!/usr/bin/env bash
 2set -euo pipefail
 3
 4PFX_FILE="${1:?usage: $0 <pfx> <pfx-pass> <namespace> <secret-name>}"
 5PFX_PASS="${2}"
 6NAMESPACE="${3}"
 7SECRET_NAME="${4}"
 8TMP_PASS="$(openssl rand -hex 8)"
 9
10WORKDIR="$(mktemp -d)"
11trap 'rm -rf "${WORKDIR}"' EXIT
12
13openssl pkcs12 -passin "pass:${PFX_PASS}" -passout "pass:${TMP_PASS}" \
14  -in "${PFX_FILE}" -nocerts -out "${WORKDIR}/tmp.key"
15
16openssl rsa -passin "pass:${TMP_PASS}" \
17  -in "${WORKDIR}/tmp.key" -out "${WORKDIR}/tls.key"
18
19openssl pkcs12 -passin "pass:${PFX_PASS}" \
20  -in "${PFX_FILE}" -nokeys -out "${WORKDIR}/tls.crt"
21
22kubectl create secret tls "${SECRET_NAME}" \
23  -n "${NAMESPACE}" \
24  --key "${WORKDIR}/tls.key" \
25  --cert "${WORKDIR}/tls.crt" \
26  --dry-run=client -o yaml

1openssl pkcs12 -legacy -passin pass:... -in file.pfx -out out.pem

1openssl pkcs8 -topk8 -nocrypt -in tls.key -out tls.pkcs8.key