Is wildcard certificates mandatory ?

[gulecroc]

Hi @lhotari,

We are moving from selfsigned certificates to our own cluster issuer.

Our issuer does not allow wildcard certificates.

I would like to know if it is mandatory ?

I test without wildcard and I don't see errors ?

Thank you.

[lhotari]

Hi @lhotari,

We are moving from selfsigned certificates to our own cluster issuer.

Our issuer does not allow wildcard certificates.

I would like to know if it is mandatory ?

I test without wildcard and I don't see errors ?

Thank you.

wildcard certs are required for broker, bookie & zk TLS when hostname verification is enabled on the client side (it should be enabled for security reason). The "client" can be a pulsar proxy or broker (towards bk, zk).
an alternative for wildcard certs would be to list all possible hostnames for SAN.