Answers: <p>There are three ways, all should return the same output. If they are not, something is wrong.</p>
  <p>All of this assumes Unix-y shell, and jq, base64, openssl installed. The secret is in <code>cert-certname</code>, the website (assuming this protects a website) is at <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a></p>
  <p>1.</p>
  <pre><code>kubectl get secret cert-certname -o json  | jq -r '.data.&quot;tls.crt&quot;' | base64 -d &gt; tls.crt
  openssl x509 -inform pem -in tls.crt -pubkey -noout
  </code></pre>
  <ol start="2">
  <li></li>
  </ol>
  <pre><code>kubectl get secret cert-certname -o json  | jq -r '.data.&quot;tls.key&quot;' | base64 -d &gt; tls.key
  openssl rsa -in tls.key -pubout
  </code></pre>
  <ol start="3">
  <li></li>
  </ol>
  <pre><code>openssl s_client -connect example.com:443 | openssl x509 -pubkey -noout
  </code></pre>
  <p>Note that 1) and 2) creates files containing secrets on your disk; you should delete them afterwards. And never ever put them to git or similar version control.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-09-13T05:53:42.137Z
Answers: 2021-09-13T05:53:42.137Z
Answers: Karel Bílek
Body: <p>I need to get a public key from cert manager from bash. How to do it properly?</p>
  <p>I can see the private key in kubernetes secrets; how to get public key that can be safely shared?</p>
  
Tags: <kubernetes><kubectl><cert-manager>
Title: How to get public key from cert-manager?
UserDisplayName: Karel Bílek
ThreadText: # How to get public key from cert-manager?
  
  (Asked by: username_0 on 2021-09-13)
  
  I need to get a public key from cert manager from bash. How to do it properly?
  
  I can see the private key in kubernetes secrets; how to get public key that can be safely shared?
  
  **Tags:** kubernetes, kubectl, cert-manager
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-09-13. Score: 0 | Accepted answer
  
  There are three ways, all should return the same output. If they are not, something is wrong.
  
  All of this assumes Unix-y shell, and jq, base64, openssl installed. The secret is in `cert-certname`, the website (assuming this protects a website) is at <https://example.com>
  
  1.
  
  ```
  kubectl get secret cert-certname -o json  | jq -r '.data."tls.crt"' | base64 -d > tls.crt
  openssl x509 -inform pem -in tls.crt -pubkey -noout
  
  ```
  
  ```
  kubectl get secret cert-certname -o json  | jq -r '.data."tls.key"' | base64 -d > tls.key
  openssl rsa -in tls.key -pubout
  
  ```
  
  ```
  openssl s_client -connect example.com:443 | openssl x509 -pubkey -noout
  
  ```
  
  Note that 1) and 2) creates files containing secrets on your disk; you should delete them afterwards. And never ever put them to git or similar version control.
  
  
  ---
  
  