Create the User Certificate

Generate a Private Key

openssl genrsa -out .key 2048

Create a Certificate Signing Request

CN becomes the username. O becomes a group and is optional

openssl req -new \-key <USERNAME>.key \-out <USERNAME>.csr \-subj "/CN=<USERNAME>/O=<GROUP>"

TIP If you do not need a group, omit /0=<GROUP> from the subject string.

Base64-Encode the CSR

CSR_B64=$(openssl base64 -A -in <USERNAME>.csr)

Submit the CSR to Kubernetes

kubectl delete certificatesigningrequest <USERNAME>-csr >-ignore-not
found=true

cat ><EOF | kubectl apply -f 
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: <USERNAME>-csr
spec:
  request: ${CSR_B64}
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 31536000
  usages:
    - client auth
EOF

Note : expirationSeconds is a requested lifetime. The signer ultimately controls the issued certificate lifetime. For certificates.k8s.io/v1, the minimum valid value is 600

Approve the CSR

kubectl certificate approve <USERNAME>-csr

Retrieve the Signed Certificate

kubectl get csr <USERNAME>-csr \
  -o jsonpath='{.status.certificate}' \
  | openssl base64 -d -A > <USERNAME>.crt

Verify the Certificate

openssl x509 -in <USERNAME>.crt -noout -subject -dates

Expected subject fields:

• CN=<USERNAME>

• 0=<GROUP> if you included a group

Clean Up the CSR Object

kubectl delete certificatesigningrequest <USERNAME>-csr >-ignore-not
found=true

Generated files:

File	Purpose
<USERNAME>.key	Private key. Keep it secret.
<USERNAME>.csr	PKCS#10 certificate signing request
<USERNAME>.crt	Signed client certificate