👋 blob wave I struggled for some time to get CSR etc to work from cert-manager, the CA i created is

RSA4096

and I have created a

Certificate Policy

where i tried to use the preset

TLS Server Certificate

When I tried to issue a cert, it constantly complained bad CSR, where the signature wasn't allowed. I tried to issue a ECDSA, but it required RSA256 or RSA512. After adding

SHA256-RSA

SHA512-RSA

to Signature Algo and adding

RSA-4096

to Key Algo, then it would issue a certificate. What am I doing wrong? i'm using cert-manager's ingress annotations to define the cert I need.

hey @Simon Karberg! Good catch on the fix. You're not doing anything wrong, this is just a mismatch between the preset defaults and your CA type. What's happening: The "TLS Server Certificate" preset defaults to ECDSA algorithms only (SHA256-ECDSA, etc. for signatures and ECDSA-P256/P384 for keys). But since your CA is RSA-4096, cert-manager naturally generates RSA-based CSRs with SHA256WithRSA signatures, which weren't in the allowed list. That's why you were getting the "bad CSR" error. Your fix was correct. Adding SHA256-RSA, SHA512-RSA to signature algorithms and RSA-4096 to key algorithms is exactly the right approach when you have an RSA CA.

i shouldn't just recreate the CA?

Hi Simon, No, you don't need to recreate the CA. Your fix is the correct one. The preset you picked only allows ECDSA, but an RSA CA can only sign certs with RSA, so it was never going to work with that preset as-is. Adding the RSA signature and key algorithms is the right way to handle it. Recreating the CA as ECDSA is only worth it if you actually want ECDSA certs. Otherwise you'd be rebuilding your whole trust chain for nothing, so I'd leave it as is.

i'm just "confused" for why the presets doesn't have RSA in it.

Each preset is built around a specific algorithm family, and the "TLS Server Certificate" one specifically defaults to ECDSA (the modern TLS default). It's not that RSA is unsupported, RSA is fully supported, and some other presets like "Code Signing" and "Email Protection" are actually RSA-only by default. The TLS Server preset just happens to assume an ECDSA CA. Since yours is RSA-4096, the preset's allowed algorithms didn't match the RSA CSR cert-manager generated, which is what triggered the "bad CSR" error. Adding the RSA signature and key algorithms (like you did) is the intended way to adapt it.