# How Do I configure Okteto with AWS Certificate Manager?

**URL:** <https://community.okteto.com/t/how-do-i-configure-okteto-with-aws-certificate-manager/272>\
**Category:** How Do I?\
**Created:** [September 29, 2022, 6:44am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-aws-certificate-manager/272 "2022-09-29T06:44:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\
**Post date:** [September 29, 2022, 6:44am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-aws-certificate-manager/272/1 "2022-09-29T06:44:13Z")

</div>

How do I configure the Okteto wildcard certificate with AWS Certificate Manager?

---

<div class="post-metadata">

**Author:** ![ramiro](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/ramiro/32/6_2.png) [@ramiro](https://community.okteto.com/u/ramiro)\
**Post date:** [February 14, 2023, 10:02pm UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-aws-certificate-manager/272/3 "2023-02-14T22:02:46Z")

</div>

Starting in [Okteto 1.5.0](https://okteto.com/docs/1.5), Okteto now fully supports using AWS Certificate Manager and an AWS Network Load Balancer (NLB)

1. Create a certificate using AWS Certificate Manager using the domain `*.example.com`, replacing `example.com` with the `subdomain` you are using in your Helm configuration file.
2. Restore the default certificate configuration by removing the section `wildcardCertificate` from your Okteto helm values file (in case you had this before)
3. Configure the Okteto Nginx Controller to create a load balancer that uses your certificate. To do that, add the following configuration to your Okteto helm values file.

```auto
ingress-nginx:
  controller:
    service:
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-type: nlb
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: <<your-certificate-arn>>
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
        service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" 
        service.beta.kubernetes.io/aws-load-balancer-alpn-policy: HTTP2Preferred

```

1. _(Required if you are NOT using AWS load balancer controller)_ Setup ALPN policy to `HTTP2Preferred` in the AWS NLB TLS listener at port 443. [Use the official AWS Docs](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/listener-update-certificates.html#update-alpn-policy) for instructions on how to do this using the console or through the AWS CLI.

---

<div class="post-metadata">

**Author:** ![fsargent](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/fsargent/32/508_2.png) [@fsargent](https://community.okteto.com/u/fsargent)\
**Post date:** [February 9, 2024, 12:02am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-aws-certificate-manager/272/4 "2024-02-09T00:02:39Z")

</div>

If this doesn’t appear to work, how would I troubleshoot it?

---

<div class="post-metadata">

**Author:** ![mario](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/mario/32/292_2.png) [@mario](https://community.okteto.com/u/mario)\
**Post date:** [February 15, 2024, 11:15am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-aws-certificate-manager/272/5 "2024-02-15T11:15:07Z")

</div>

Hi @fsargent !

Could you try to run `curl https://domainOfNLB -v` first?

If you get something like:

```auto
HTTP/1.1 502 Bad Gateway

```

**Try to do this steps in AWS:**

- Go to EC2
- Go to Load Balancers
- find the same that you get from `kubectl get svc -n okteto | grep ingress-nginx | awk '{print $4}'`
- Listener TLS
- Edit Listener
- ALPN Policy → HTTP2 Preferred

This will take a few minutes to be ready, once you run the `curl` command again and you see `GET HTTP 2 `

Let me know if that was your case, if not we can continue troubleshooting!