To secure a Rancher server on a Linux VPS, install cert-manager in the Kubernetes cluster, point a public DNS name at the VPS or its load balancer, expose TCP ports 80 and 443, and install Rancher with ingress.tls.source=letsEncrypt. Test issuance against Let’s Encrypt’s staging service first, then switch the Helm release to production. cert-manager creates and renews the certificate; your job is to keep DNS, ingress routing, and the HTTP-01 validation path reachable.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What this setup does
Rancher runs on Kubernetes and is normally installed with Helm. Its Let’s Encrypt integration depends on cert-manager, which requests a certificate through the ACME protocol and stores it in Kubernetes. Rancher’s ingress then presents that certificate for the hostname you configure.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe common VPS design uses ACME HTTP-01 validation. Let’s Encrypt sends an HTTP request to a temporary path below /.well-known/acme-challenge/. The request must reach the ingress handling your Rancher hostname on TCP port 80. Rancher’s normal web traffic uses ports 80 and 443, so both ports must be reachable from the internet. SUSE’s Rancher documentation states: “You need to have port 80 open as the HTTP-01 challenge can only be done on port 80.”
For an internal-only or split-horizon hostname, HTTP-01 is the wrong validation method. In that case, use cert-manager’s DNS-01 solver with a DNS provider that can publish the required TXT record.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Prerequisites and design checks
Use a supported Kubernetes and Helm installation
- Run Rancher on a supported Kubernetes distribution installed on the Linux VPS or on the cluster behind it.
- Install Helm on the administration machine from which you will add the Rancher chart repository and run the release commands.
- Make sure the cluster can schedule cert-manager and Rancher pods and can reach the internet for ACME communication.
Choose the final hostname first
Pick the exact fully qualified name users and Rancher agents will use, such as rancher.example.com. Create an A record for the VPS’s public IPv4 address and, if you use IPv6, an AAAA record for the public IPv6 address. If a load balancer terminates or forwards traffic, point both records to that load balancer instead. The hostname in the Rancher Helm values must match the DNS name and the certificate’s subject alternative name.
Open the complete network path
- Allow inbound TCP 80 and TCP 443 in the VPS firewall, cloud security group, and any load-balancer listener.
- Route those ports to the Kubernetes ingress controller that will serve Rancher.
- Do not place a reverse proxy in front of the cluster if it blocks or rewrites
/.well-known/acme-challenge/. - Ensure IPv6 is genuinely routed if an AAAA record exists. An unreachable IPv6 address can make validation fail even when IPv4 works.
Check for split-horizon DNS
Resolve the hostname from outside your private network. Public ACME servers must receive the public address, not an RFC1918 address or an internal-only load balancer. Internal DNS views can still be used for clients after issuance only when the public validation path remains available; otherwise select DNS-01 and configure the DNS provider API.
How cert-manager and Let’s Encrypt validate Rancher
HTTP-01: the straightforward public-VPS method
With HTTP-01, cert-manager requests a challenge and creates temporary solver resources in the cluster. The ingress routes a computed token at a URL under http://your-hostname/.well-known/acme-challenge/. Let’s Encrypt retrieves that URL over port 80. When the response matches, the certificate is issued and cert-manager removes the temporary solver resources.
HTTP-01 is appropriate when the hostname is publicly resolvable and port 80 can remain open. Redirecting ordinary HTTP traffic to HTTPS is normally fine, but a proxy or ingress rule must not swallow the challenge path before it reaches the solver.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
DNS-01: for private or split-horizon deployments
DNS-01 proves control by asking cert-manager to publish a TXT record at the ACME challenge name. No inbound port 80 request is needed, so it works when the Rancher service is private or when opening port 80 is impossible. You must, however, give cert-manager suitable API access to the authoritative DNS provider and allow TXT changes to propagate.
| Decision factor | HTTP-01 | DNS-01 |
|---|---|---|
| Public hostname | Required; Let’s Encrypt must reach the hostname over the internet. | Not required for the Rancher service itself, but the DNS zone must be publicly authoritative for public ACME validation. |
| Port 80 | Must be open and routed to the selected ingress class. | Can remain closed to the ACME solver. |
| DNS-provider API | Not required for the challenge. | Required so cert-manager can create and remove TXT records. |
| Split-horizon or internal-only Rancher | Usually unsuitable because the public validator cannot reach the internal address. | Suitable when the DNS provider supports the required TXT updates. |
| Operational complexity | Lower on a simple public VPS; depends on correct ingress and firewall routing. | Higher initial setup because credentials, permissions, and TXT propagation must be managed. |
Prepare the VPS, DNS, and ingress
- Install Kubernetes and Helm. Use versions supported by the Rancher release you intend to deploy. Confirm that
kubectlpoints to the target cluster and that nodes are Ready. - Create DNS records. Publish the A and, where applicable, AAAA record for the final Rancher hostname. Wait for the records to resolve from an external network.
- Allow 80 and 443. Apply rules at every layer: cloud firewall, VPS firewall, security group, load balancer, and Kubernetes ingress service.
- Identify the ingress class. Record the class name used by the controller that should serve Rancher. You will pass that value to
letsEncrypt.ingress.classwhen the chart requires an explicit class. - Remove conflicting front-end rules. A separate proxy must preserve the original host header and allow the ACME path to reach the Rancher ingress. Do not force authentication, IP allow-lists, or a custom 404 handler on that path.
Install cert-manager before Rancher
Rancher’s Let’s Encrypt option does not install cert-manager for you. Add the Jetstack chart repository, install the cert-manager CRDs, and deploy the controller in the cert-manager namespace using the currently documented cert-manager installation method for your Kubernetes version.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →After installation, wait for every cert-manager component to report Ready before creating the Rancher release. A basic health check is:
kubectl get pods -n cert-manager
The controller, webhook, and cainjector should be running without repeated restarts. If the CRDs are missing or the webhook is unhealthy, Rancher’s certificate resources cannot be reconciled and an ACME order will remain pending.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Install Rancher with Let’s Encrypt staging
Use the Rancher chart values below as a pattern. Replace the hostname, initial bootstrap password, chart repository alias, and ingress class with your own values. Keep the password out of shell history where your operating policy requires a secret-management mechanism.
helm install rancher rancher-<CHART_REPO>/rancher
--namespace cattle-system
--set hostname=rancher.example.com
--set bootstrapPassword='<strong-initial-password>'
--set ingress.tls.source=letsEncrypt
--set [email protected]
--set letsEncrypt.environment=staging
--set letsEncrypt.ingress.class=<your-ingress-class>
Create the cattle-system namespace first if your chart workflow does not create it automatically. The email address is used for ACME account notices; use an address that is monitored. The staging environment lets you test DNS, ingress, and firewall routing without consuming production issuance limits, but staging certificates are not trusted by browsers.
When the ingress class flag is optional
Some chart and ingress-controller combinations select the default ingress class automatically. If your cluster has one unambiguous default, the chart may work without an explicit class. When more than one controller exists, or when the controller is not marked default, set letsEncrypt.ingress.class to the exact class that serves the Rancher hostname. An incorrect class is a common reason that the solver creates resources that never receive the public request.
Watch the ACME order and challenge
Immediately after installing Rancher, inspect the certificate-related resources:
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
kubectl get certificate,certificaterequest,order,challenge -A
Follow the resource events when a challenge is pending or failed. The Challenge object records the URL cert-manager expects Let’s Encrypt to fetch and normally includes a reason for failure. The temporary solver ingress and service should appear while validation is in progress and disappear after successful issuance.
- Pending with no request reaching the solver: verify the public A/AAAA records, NAT, load-balancer listener, and both firewall layers.
- 404 or an application response: check that the selected ingress class owns the challenge ingress and that a redirect or proxy is not replacing the solver response.
- Timeout: test TCP 80 from an external network and inspect cloud security-group and VPS firewall logs.
- Wrong address: remove stale A or AAAA records, or correct the load-balancer target. Public validators may choose either address family.
- Webhook or CRD errors: return to cert-manager pod health and confirm that all required CRDs were installed.
Switch from staging to a trusted production certificate
Do not leave staging enabled for a live Rancher URL: browsers and Rancher agents will not trust the staging chain. Once the staging challenge completes successfully, upgrade the same Helm release and change only the ACME environment:
helm upgrade rancher rancher-<CHART_REPO>/rancher
--namespace cattle-system
--set hostname=rancher.example.com
--set ingress.tls.source=letsEncrypt
--set [email protected]
--set letsEncrypt.environment=production
--set letsEncrypt.ingress.class=<your-ingress-class>
Keep the other values used by the original release, preferably in a version-controlled Helm values file, so an upgrade does not reset bootstrap or ingress settings. Monitor the new Order and Certificate resources until the production certificate is Ready.
Verify Rancher and its certificate
- Wait for the deployment to become available:
kubectl -n cattle-system rollout status deploy/rancher - Open
https://rancher.example.comin a browser and confirm there is no certificate warning. - Inspect the served certificate’s hostname and chain with your browser’s certificate viewer or an equivalent TLS inspection tool. The certificate SAN must include the exact Rancher hostname.
- Sign in and confirm the Rancher UI loads through HTTPS without mixed-content or websocket errors.
- Check downstream Rancher agents and imported clusters. Agents must be able to resolve the hostname and establish TLS to the same public endpoint.
Handle strict Rancher agent TLS mode
New Rancher installations can use strict agent-tls-mode. In that mode, downstream agents validate the CA chain more strictly than a browser that merely sees a publicly trusted certificate. Rancher’s installation guidance requires setting privateCA=true and uploading the Let’s Encrypt CA as directed by Rancher when strict mode is enabled.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Treat this as a production runbook step, not an optional cleanup task. Record which CA secret or upload procedure your Rancher version requires, apply it before registering downstream clusters, and verify an agent connection after the certificate is issued. If agents cannot connect while the UI works, inspect the agent logs and confirm that privateCA=true, the required CA material, and the Rancher hostname are all consistent.
Free tools Windows power users keep installed
One-click scans. No signup required.
Renewal and ongoing operations
After a production certificate is issued, cert-manager watches the Certificate resource and renews it automatically. Automatic renewal does not repair a broken network path: DNS must continue to point at the endpoint, port 80 must remain reachable for HTTP-01, and the ingress class must continue routing the solver.
- Keep the A/AAAA records under change control and remove obsolete addresses.
- Monitor cert-manager events and certificate readiness rather than waiting for an outage.
- Retain the email account used for ACME notifications.
- Test a renewal after major ingress, load-balancer, firewall, or DNS changes.
- Back up the Helm values and document the strict-agent-TLS CA procedure.
Troubleshooting by symptom
| Symptom | Likely cause | What to check first |
|---|---|---|
| Challenge stays pending | Public DNS, port 80, NAT, or firewall is wrong. | Resolve A/AAAA externally; test that TCP 80 reaches the intended load balancer or ingress. |
| Challenge returns 404 | The solver ingress is handled by a different controller or path rules override it. | Compare letsEncrypt.ingress.class with the active ingress class and inspect temporary solver resources. |
| Challenge receives a redirect loop | A proxy or ingress policy rewrites the ACME path. | Allow /.well-known/acme-challenge/ through unchanged while retaining normal HTTP-to-HTTPS behavior elsewhere. |
| Certificate is issued but browser warns | Staging environment, wrong hostname, or incomplete chain is being served. | Confirm letsEncrypt.environment=production, inspect SANs, and verify the served chain. |
| Rancher agents cannot connect | Agent TLS mode, CA upload, DNS, or egress differs from the browser path. | Check privateCA=true, the required CA secret/upload, agent logs, and agent-side DNS resolution. |
| Renewal fails later | Port 80, DNS, ingress, or firewall changed after initial issuance. | Inspect the latest Challenge events and revalidate the complete public path. |
Security checklist for a production VPS
- Use a unique, strong Rancher bootstrap password and rotate it according to your access policy.
- Restrict Kubernetes administration access separately from public Rancher web access.
- Allow only the required inbound ports; HTTP-01 requires TCP 80, while Rancher HTTPS requires TCP 443.
- Keep Kubernetes, Helm, Rancher, cert-manager, and the ingress controller on supported versions.
- Use least-privilege DNS API credentials if you choose DNS-01.
- Monitor certificate readiness, ingress availability, and downstream-agent health.
- Document the exact hostname, ingress class, Helm values, and strict-agent-TLS CA procedure so another operator can recover the service.
Choosing the right validation method
For a conventional public Linux VPS, HTTP-01 is usually the shortest path: public DNS points to the endpoint, port 80 reaches the selected ingress, and cert-manager handles temporary solver resources. Choose DNS-01 instead when the Rancher endpoint must remain private, the network cannot expose port 80, or split-horizon DNS makes public HTTP routing unreliable. The certificate source is still Let’s Encrypt; only the proof-of-control mechanism changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
