> For the complete documentation index, see [llms.txt](https://docs.cloudeka.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudeka.ai/reference/kubernetes-user-creation-with-rbac/create-the-user-certificate.md). # Create the User Certificate ### Generate a Private Key ``` openssl genrsa -out .key 2048 ``` ### Create a Certificate Signing Request `CN` becomes the username. `O` becomes a group and is optional ``` openssl req -new \-key .key \-out .csr \-subj "/CN=/O=" ``` {% hint style="info" %} TIP\ If you do not need a group, omit `/0=` from the subject string. {% endhint %} ### Base64-Encode the CSR ``` CSR_B64=$(openssl base64 -A -in .csr) ``` ### Submit the CSR to Kubernetes ``` kubectl delete certificatesigningrequest -csr >-ignore-not found=true ``` ``` cat >-csr spec: request: ${CSR_B64} signerName: kubernetes.io/kube-apiserver-client expirationSeconds: 31536000 usages: - client auth EOF ``` {% hint style="info" %} Note : `expirationSeconds` is a requested lifetime. The signer ultimately controls the issued\ certificate lifetime. For `certificates.k8s.io/v1`, the minimum valid value is `600` {% endhint %} ### Approve the CSR ``` kubectl certificate approve -csr ``` ### Retrieve the Signed Certificate ``` kubectl get csr -csr \ -o jsonpath='{.status.certificate}' \ | openssl base64 -d -A > .crt ``` ### Verify the Certificate ``` openssl x509 -in .crt -noout -subject -dates ``` **Expected subject fields:** * `CN=` * `0=` if you included a group ### Clean Up the CSR Object ``` kubectl delete certificatesigningrequest -csr >-ignore-not found=true ``` **Generated files:**

File	Purpose
`<USERNAME>.key`	Private key. Keep it secret.
`<USERNAME>.csr`	PKCS#10 certificate signing request
`<USERNAME>.crt`	Signed client certificate