The reliable way to secure a Rancher installation on a Linux VPS is to install cert-manager in the Kubernetes cluster, point a public DNS name at the VPS or its load balancer, and install Rancher with ingress.tls.source=letsEncrypt. Start with Let’s Encrypt’s ACME staging environment, confirm that the HTTP-01 challenge can reach your ingress on TCP port 80, then switch the release to production. cert-manager creates and renews the certificate; you do not need to copy renewed files into Rancher manually.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the finished setup looks like
A browser connects to https://rancher.example.com on port 443. The Rancher ingress terminates TLS and serves the certificate issued by Let’s Encrypt. cert-manager watches the certificate resource and performs future renewals. During initial issuance, Let’s Encrypt asks cert-manager to prove control of the hostname. With HTTP-01, cert-manager creates temporary solver resources so a request to a path below /.well-known/acme-challenge/ returns the required validation value over ordinary HTTP on port 80.
As an Amazon Associate I earn from qualifying purchases.
This arrangement has four separate dependencies:
- The hostname must resolve publicly to the VPS or to the load balancer that forwards traffic to the cluster.
- Inbound TCP ports 80 and 443 must be allowed through the cloud firewall, VPS firewall, security groups, NAT and load balancer.
- The selected Kubernetes ingress class must actually receive traffic for the Rancher hostname.
- cert-manager’s CRDs and controllers must be healthy before Rancher is installed.
If any one of those dependencies is wrong, Rancher may still deploy while certificate issuance remains pending or fails.
Prerequisites on the Linux VPS
A supported Kubernetes distribution and Helm
Rancher is installed with Helm on Kubernetes, not as a standalone process on the VPS. Prepare a supported Kubernetes distribution, a working kubectl context with cluster-admin permissions, and Helm. Confirm that you are operating on the intended cluster before creating the cattle-system or cert-manager namespaces.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
kubectl cluster-info
helm version
kubectl get nodesAll nodes should be Ready, and the cluster must have enough capacity for Rancher, cert-manager and the ingress controller. The exact node size depends on the Kubernetes distribution and the rest of your workloads; the certificate workflow itself does not remove Rancher’s normal resource requirements.
A public Rancher hostname
Choose the final name users and agents will use, such as rancher.example.com. Create an A record for the VPS’s public IPv4 address and, if you use IPv6, an AAAA record for the correct public IPv6 address. If a load balancer is in front of Kubernetes, point the records to that load balancer instead.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check the answer from a network outside your VPS. An internal resolver can hide a broken public record, especially when split-horizon DNS is in use. Every public address returned for the name must lead to the same ingress path; a stale AAAA record can make some Let’s Encrypt validation attempts reach the wrong machine.
Network and proxy rules
Allow inbound TCP 80 and 443 at every layer: provider firewall, VPS firewall, security group, NAT gateway and load balancer listener. Rancher’s web interface uses ports 80 and 443. The HTTP-01 challenge specifically requires port 80; SUSE’s Rancher documentation states, “You need to have port 80 open as the HTTP-01 challenge can only be done on port 80.”
Do not place a proxy, WAF or redirecting service in front of the ingress if it blocks or rewrites /.well-known/acme-challenge/. Normal HTTP-to-HTTPS redirection can coexist with ACME, but the challenge request must still reach the cert-manager solver and return its expected response.
Install cert-manager before Rancher
Rancher’s Let’s Encrypt integration depends on cert-manager. Install the current cert-manager release using the currently documented installation method (for example, its maintained chart repository or release manifests), including the cert-manager CRDs. Deploy it in the cert-manager namespace unless your installation method documents another namespace.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Do not continue until the CRDs and controller pods are ready:
kubectl get crd | grep cert-manager
kubectl get pods -n cert-managerThe controller, webhook and cainjector pods should report Running and Ready. If they are restarting, inspect their logs and events first. A Rancher installation started before cert-manager is ready can leave certificate resources waiting and makes diagnosis harder.
Keep cert-manager’s namespace and release under your normal backup and upgrade process. Its custom resources contain the state cert-manager needs to manage issuers, orders, challenges and certificates.
Install Rancher with Let’s Encrypt staging
Use the Rancher chart values that select Let’s Encrypt as the ingress TLS source, identify the hostname, provide an email address for ACME account notices, and select the ingress class that serves the public endpoint. The following command shows the required settings; replace the chart repository and ingress class with the values used by your cluster.
Recommended Free Tools
helm install rancher rancher-<CHART_REPO>/rancher
--namespace cattle-system
--create-namespace
--set hostname=rancher.example.com
--set bootstrapPassword='<strong-initial-password>'
--set ingress.tls.source=letsEncrypt
--set [email protected]
--set letsEncrypt.environment=staging
--set letsEncrypt.ingress.class=<your-ingress-class>bootstrapPassword is the initial Rancher administrator password. Use a strong, unique value and protect shell history and deployment logs because Helm arguments can be recorded by automation. The email value identifies the ACME account and should be monitored.
The ingress-class setting matters when your cluster has more than one ingress controller or when the controller does not use the default class. If the class is wrong, cert-manager can create a solver while requests continue to land on a different controller.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Staging certificates are for testing. They are not trusted for normal browser use, but they let you validate DNS, routing, firewall and ingress behavior without consuming production issuance capacity while repeatedly correcting configuration.
Watch the ACME order and challenge
Immediately after installing Rancher, inspect the certificate workflow across namespaces:
Free tools Windows power users keep installed
One-click scans. No signup required.
kubectl get certificate,certificaterequest,order,challenge -Acert-manager normally creates an Order and a Challenge, then temporary solver resources for HTTP-01. Follow the events on the individual resources when a state remains pending or becomes invalid:
kubectl describe challenge <challenge-name> -n <challenge-namespace>
kubectl describe order <order-name> -n <order-namespace>
kubectl describe certificate <certificate-name> -n <certificate-namespace>The Challenge events identify the exact URL and failure reason. A successful flow ends with a Ready certificate and a Kubernetes TLS secret referenced by the Rancher ingress. cert-manager removes temporary solver resources after the validation completes.
What the external validator must be able to do
- Resolve
rancher.example.comto the public address currently serving the cluster. - Open a TCP connection to port 80 on that address.
- Reach the ingress class selected in
letsEncrypt.ingress.class. - Receive the solver response under
/.well-known/acme-challenge/without authentication, a login page or a proxy-generated error.
Testing only from inside the VPS is insufficient. Hairpin NAT, internal DNS and local firewall rules can make a path appear healthy while an external validator reaches a different address.
Switch from staging to the production authority
After the staging challenge succeeds and you have confirmed that the hostname, ingress and certificate secret are correct, upgrade the same Helm release with the production environment. Keep every other value unchanged.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
helm upgrade rancher rancher-<CHART_REPO>/rancher
--namespace cattle-system
--set hostname=rancher.example.com
--set ingress.tls.source=letsEncrypt
--set [email protected]
--set letsEncrypt.environment=production
--set letsEncrypt.ingress.class=<your-ingress-class>Use the chart version and values-management approach appropriate for your Rancher release. If you manage values in a file, update the environment there and run the equivalent helm upgrade rather than mixing an old file with ad-hoc flags.
Production issuance can take a short time. Continue watching the Order, Challenge and Certificate resources instead of repeatedly reinstalling Rancher. Reinstalling creates unnecessary state changes and can make the original failure harder to identify.
Verify HTTPS, Rancher and downstream agents
Check the deployment rollout
kubectl -n cattle-system rollout status deploy/rancherWait for the rollout to complete, then open https://rancher.example.com. The browser should show the requested hostname, a trusted chain and no certificate-name warning. Inspect the presented certificate’s subject alternative names and expiration from a client outside the VPS; the hostname must be included.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsConfirm the ingress and secret
kubectl -n cattle-system get ingress
kubectl -n cattle-system describe ingress rancherConfirm that the ingress has the expected hostname, class and TLS configuration. The certificate secret should be managed by cert-manager rather than replaced by a manually copied file. Avoid editing that secret directly: cert-manager needs ownership of it to renew and update the certificate.
Test agent connectivity
Rancher agents in downstream clusters must be able to resolve and reach the same public hostname over HTTPS. A browser test from the administrator’s laptop does not prove that a private node, a different network or an IPv6 client can connect. Check the agent logs if registration or cluster provisioning stalls after the UI becomes available.
HTTP-01 versus DNS-01: choose the validation method deliberately
Rancher’s Let’s Encrypt option commonly uses cert-manager’s ACME integration with HTTP-01. DNS-01 is the alternative when HTTP validation is unsuitable.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
| Decision factor | HTTP-01 | DNS-01 |
|---|---|---|
| Public reachability | Hostname must be publicly reachable and route to the ingress. | The web service need not be publicly reachable, but the DNS zone must be controllable. |
| Port requirement | Requires inbound TCP port 80 for the challenge. | Does not require port 80; validation uses a DNS TXT record. |
| DNS access | No DNS-provider API is required after the record exists. | cert-manager needs permission to publish and remove TXT records through a supported DNS provider. |
| Split-horizon or internal names | Usually unsuitable when public resolvers cannot reach the internal ingress. | Suitable when the provider can publish the required TXT record for the authoritative public zone. |
| Operational complexity | Simpler for a public VPS, but sensitive to firewalls, redirects, NAT and ingress selection. | More DNS credentials and provider configuration, but avoids exposing an HTTP endpoint. |
Use HTTP-01 for a normal public Rancher VPS when port 80 can be opened cleanly. Consider DNS-01 for a private or split-horizon deployment, or when policy forbids exposing port 80 and your DNS provider can automate TXT records. The validation method is an ACME/cert-manager design choice; do not assume changing it fixes an unrelated DNS or ingress error.
Strict Rancher agent TLS and private CA handling
New Rancher installations can use strict agent TLS enforcement. In that mode, the installation guide requires the privateCA=true setting and an additional procedure to upload the Let’s Encrypt CA as directed by Rancher. This is separate from obtaining the public certificate for the web ingress.
Include the CA setting and upload step in the production runbook before registering downstream clusters. If strict mode is enabled without the required CA secret or upload, agents can reject the server certificate and downstream-cluster connections can fail even though the Rancher UI loads normally. Record where the CA material is stored, who can rotate it and how agents will receive an updated trust chain.
Troubleshoot a pending or failed challenge
| Symptom | Likely cause | What to check |
|---|---|---|
| Challenge remains pending | External traffic never reaches the solver. | Public A/AAAA records, TCP 80, load-balancer listener, NAT and the selected ingress class. |
| 404 or an application page at the challenge URL | Another ingress or proxy handles the path. | Ingress-class value, path routing and proxy rules for /.well-known/acme-challenge/. |
| Connection timeout | Cloud or host firewall blocks port 80. | Provider firewall, security groups, VPS firewall and any intermediate load balancer. |
| Works on IPv4 but fails intermittently | AAAA points to a stale or incorrect IPv6 endpoint. | Remove or correct the AAAA record, then retest from an IPv6-capable external network. |
| Solver resources exist but validation still fails | Split-horizon DNS or NAT sends the validator elsewhere. | Resolve the hostname using public DNS and verify the returned address reaches this ingress. |
| Certificate is issued but browser warns | Hostname mismatch or staging certificate. | Inspect the certificate SANs and confirm the environment is production. |
| UI works but agents cannot connect | Agent TLS trust is incomplete or agents cannot reach the public endpoint. | Check agent logs, strict-mode privateCA=true, the required CA upload and outbound HTTPS routing. |
Start with the Challenge event because it reports the validator’s observed failure. Then verify DNS and port 80 from outside the VPS. Only after public routing is correct should you investigate Helm values or cert-manager internals.
Renewal and ongoing operations
Once the production Certificate is Ready, cert-manager monitors it and renews it automatically. You should still monitor Certificate status, controller health and expiration because automatic renewal depends on the same DNS and port-80 path used for the first issuance.
Do not delete the certificate secret to “force” renewal. Inspect the Certificate and its related Order and Challenge resources first. If you change the hostname, ingress controller, load balancer or DNS provider, test the new route before the existing certificate approaches expiration.
Keep a record of the Helm values used for the Rancher release, the ingress class, the public DNS records, firewall rules and the strict-agent-TLS CA procedure. This documentation turns a future VPS migration into a controlled DNS and ingress change rather than a fresh troubleshooting exercise.
Production readiness checklist
- Kubernetes nodes are Ready and Helm operates on the intended cluster.
- The Rancher hostname’s public A and AAAA records point to the active VPS or load balancer.
- TCP 80 and 443 are allowed through every firewall and load-balancer layer.
- cert-manager CRDs, controller, webhook and cainjector are Ready.
- Rancher uses
ingress.tls.source=letsEncrypt, the correct email and the correct ingress class. - Staging HTTP-01 issuance completed before production issuance was attempted.
- The production Certificate is Ready and the browser sees a trusted chain for the Rancher hostname.
- The HTTP-01 path is not blocked by a proxy, authentication rule or redirect handler.
- Downstream agents can resolve and reach Rancher over HTTPS.
- If strict agent TLS is enabled,
privateCA=trueand Rancher’s required CA upload are complete. - Certificate status, cert-manager health, DNS and firewall ownership are included in ongoing monitoring and change records.
Final result
For a public Linux VPS, the shortest dependable path is: make DNS and ports 80/443 correct, install and verify cert-manager, install Rancher with Let’s Encrypt staging and the right ingress class, inspect the HTTP-01 Challenge, switch to production only after staging succeeds, and verify both the browser certificate and agent connectivity. cert-manager then handles renewal, while your operations work is keeping the public route and strict-agent-TLS trust configuration intact.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
