# Good practices in handling CA (certificate authority)

**URL:** <https://discuss.kubernetes.io/t/good-practices-in-handling-ca-certificate-authority/18517>\
**Category:** microk8s\
**Tags:** security\
**Created:** [December 26, 2021, 8:41pm UTC](https://discuss.kubernetes.io/t/good-practices-in-handling-ca-certificate-authority/18517 "2021-12-26T20:41:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![hoba](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/hoba/32/8560_2.png) [@hoba](https://discuss.kubernetes.io/u/hoba)\
**Post date:** [December 26, 2021, 8:41pm UTC](https://discuss.kubernetes.io/t/good-practices-in-handling-ca-certificate-authority/18517/1 "2021-12-26T20:41:44Z")

</div>

Hi,

I am running a microk8s cluster with 3 nodes on which I am setting up MongoDB Kubernetes Community Operator according to a guidance from [here](https://www.mongodb.com/blog/post/run-secure-containerized-mongodb-deployments-using-the-mongo-db-community-kubernetes-oper). When it comes to securing the Replica Set with TLS, then it’s stated that a I should:

> […] generate a CA certificate, or use your own. […]

I wonder now if in a microk8s cluster it is now good practice to use the `ca.crt` from `/var/snap/microk8s/current/certs/ca.crt` which I prior should change by adding the subject alt names to the `csr.conf` (DNS1 = xyz, …)? Is this meant like this? Or rather creating a new CA from scratch and use this CA only for the purpose of MongoDB?

Latter I tried already, but I am struggling quite a bit with openssl.

Any hints, ideas, comments are highly appreciated.

Cheers