[Question] What is behind when mqtts is just work by default installation

[wemod123]

By following the guide to install emqx-operator, the mqtts is just working without any additional tls configuration.

Question is:

1. How it works, where is the certificate passed to tls config, is it passed by cert-manager ?
2. If certificate is passed, what is the default config, e.g. valid period, how to renew it periodically?

[wemod123]

Update:
I find the document says the certificate is self-signed certificates generated by EMQX Broker.

Then the question would be If I want to use this self-signed cert, how to renew it?

[Rory-Z]

Hi, @wemod123 EMQX provides a default certificate, but we do not recommend using it in a production environment
You can create your-self tls secret resource, and mount it in EMQX pods, by .spec.emqxTemplate.extraVolumeMounts and .spec.emqxTemplate.extraVolumes
Will this solve your problem? Please let me know

[wemod123]

Thank you for reply, you had submit a feat: add cert for listener, will that work?

[Rory-Z]

Sorry about that, this PR is working in v1beta2 APIVersion, but in v1beta3 version, we delete this. So you need use .spec.emqxTemplate.extraVolumeMounts and .spec.emqxTemplate.extraVolumes