// Module included in the following assemblies:
//
// assembly-managing-address-spaces.adoc

[id='ref-address-space-example-cert-providers-{context}']
= Address space certificate provider configuration examples

The following address space examples show how you can configure the endpoints of an `AddressSpace` using different certificate providers. The certificate provider determines how certificates are issued for the endpoints of an `AddressSpace`.

ifeval::["{cmdcli}" =="oc"]
== `openshift` provider

The `openshift` certificate provider can be used to configure endpoints with certificates signed by
the OpenShift cluster certificate authority (CA).

[source,yaml,options="nowrap"]
----
apiVersion: enmasse.io/v1beta1
kind: AddressSpace
metadata:
  name: myspace
spec:
  type: standard
  plan: standard-unlimited
  authenticationService:
    name: standard-authservice
  endpoints:
  - name: messaging
    service: messaging
    cert:
     provider: openshift <1>
----
<1> (Required) The certificate provider type. Valid values are `openshift` (on OpenShift only), `certBundle`, and `selfsigned` (default value).
endif::[]

== `selfsigned` provider

The `selfsigned` certificate provider can be used to configure endpoints with self-signed
certificates. The CA for these certificates can be found in the `status.caCert` field of the
`AddressSpace` resource.

[source,yaml,options="nowrap"]
----
apiVersion: enmasse.io/v1beta1
kind: AddressSpace
metadata:
  name: myspace
spec:
  type: standard
  plan: standard-unlimited
  authenticationService:
    name: standard-authservice
  endpoints:
  - name: messaging
    service: messaging
    cert:
     provider: selfsigned <1>
----
<1> (Required) The certificate provider type. Valid values are `openshift` (on OpenShift only), `certBundle`, and `selfsigned` (default value).

== `certBundle` provider

The `certBundle` certificate provider can be used to configure endpoints with user-supplied
certificates signed by your own CA. Certificate rotation can be performed by updating the `tlsKey` and
`tlsCert` fields with updated certificates, and then updating the `AddressSpace` resource.

[source,yaml,options="nowrap"]
----
apiVersion: enmasse.io/v1beta1
kind: AddressSpace
metadata:
  name: myspace
spec:
  type: standard
  plan: standard-unlimited
  authenticationService:
    name: standard-authservice
  endpoints:
  - name: messaging
    service: messaging
    cert:
     provider: certBundle <1>
     tlsKey: Y2VydGJ1bmRsZXByb3ZpZGVyY2VydA== <2>
     tlsCert: Y2VydGJ1bmRsZXByb3ZpZGVyY2VydA== <3> 
----
<1> (Required) The certificate provider type. Valid values are `openshift` (on OpenShift only), `certBundle`, and `selfsigned` (default value).
<2> (Required) The base64-encoded value of the PEM private key (including the preamble).
<3> (Required) The base64-encoded value of the PEM certificate (including the preamble).

