# How Do I configure Okteto with cert-manager and Azure Cloud DNS?

**URL:** <https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-azure-cloud-dns/275>\
**Category:** How Do I?\
**Created:** [September 29, 2022, 6:48am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-azure-cloud-dns/275 "2022-09-29T06:48:02Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\
**Post date:** [September 29, 2022, 12:45pm UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-azure-cloud-dns/275/2 "2022-09-29T12:45:26Z")

</div>

The recommended solution is to use [Azure Workload Identity](https://azure.github.io/azure-workload-identity/docs/quick-start.html).

In order to do that, create an Azure Service Principal following the [cert-manager recommendations](https://cert-manager.io/docs/configuration/acme/dns01/azuredns/#service-principal).

Federate the Application Client ID with the cert-manager service account as explained [here](https://azure.github.io/azure-workload-identity/docs/quick-start.html#6-establish-federated-identity-credential-between-the-aad-application-and-the-service-account-issuer--subject) and add these options to your cert-manager Helm values configuration:

```auto
  extraArgs: [--issuer-ambient-credentials=true]
  serviceAccount:
    annotations:
      azure.workload.identity/client-id: <<your-application-client-id>>

```

Once your cert-manager is configured this way, create the following `Issuer` in the `okteto` namespace:

```auto
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: okteto-letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: "<<your-email>>"
    privateKeySecretRef:
      name: okteto-letsencrypt-acme
    solvers:
    - http01:
        ingress:
          serviceType: ClusterIP
          class: nginx
    - dns01:
        azureDNS:
          clientID: "<<your-application-client-id>>"            
          subscriptionID: "<<your-subscription-id>>"            
          tenantID: "<<your-tenant-id>>"            
          resourceGroupName: "<<resource-group-name>>" 
          hostedZoneName: "<<your-okteto-subdomain>>"            
          environment: AzurePublicCloud

```

and the following Certificate:

```auto
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: okteto-letsencrypt
spec:
 secretName: okteto-letsencrypt
 duration: 8760h0m0s
 renewBefore: 600h0m0s # 25d
 issuerRef:
   name: okteto-letsencrypt
   kind: Issuer
 dnsNames:
   - "*.<<your-okteto-subdomain>>"

```

Now, add the following to your Okteto Helm configuration file to tell Okteto and NGINX to use your certificate:

```auto
wildcardCertificate:
  create: false
  name: okteto-letsencrypt

ingress-nginx:
  controller:
    extraArgs:
      default-ssl-certificate: $(POD_NAMESPACE)/okteto-letsencrypt

```

Finally, upgrade your Okteto installation for the new configuration to be applied.

For troubleshooting, you can check the cert manager logs, and the events associated to the resources `Challenge` , `Order` and `CertificateRequest`.

---

_[View the full topic](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-azure-cloud-dns/275)._