Rancher CA certs

1

I’m using RKE2 and installed the chart using the following command:

helm upgrade -i rancher rancher-chart \
        --namespace cattle-system \
        --set hostname='rancher.test.net' \
        --set bootstrapPassword=$boot_pass \
        --set privateCA=true \
        --set ingress.tls.source=secret \
        --set ingress.tls.ingressClassName=nginx

To create secrets, I followed the instructions in this guide
However, when I tried to add a node, I received the following error:

[INFO]  Value from https://rancher.test.net/cacerts is an x509 certificate
[ERROR]  Configured cacerts checksum (1382944946dbe8c6faf7d0bd6d33d6593f3416579e75efa6ad852c2e24453016) does not match given --ca-checksum (543edb437be8e3b68c60bb09fc27bde24f26ce62bec2e44e182681c2df6ed06b)
[ERROR]  Please check if the correct certificate is configured at https://rancher.test.net/cacerts

When I navigate to https://rancher.test.net/cacerts, it shows the value from the tls-rancher-internal-ca secret.
Manually updating the tls-rancher-internal-ca secret resolves the issue if you’re using a private CA. (https://github.com/rancher/rancher/issues/36632#issuecomment-1633600724)
Any thoughts? Did I miss something?

Rancher chart version: 2.11.2
RKE2 version: v1.31.9+rke2r1

1 Like