執行 kubectl -n apigee get apigeeissues 後，系統會顯示類似下列的錯誤訊息：
NAME SEVERITY REASON DOCUMENTATION AGE
ca-cert-invalid-my-org-my-virtualhost ERROR AIS_INGRESS_MTLS_CA_CERT_INVALID https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_MTLS_CA_CERT_INVALID 5h18m
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[[["\u003cp\u003eThis document pertains specifically to Apigee hybrid users and addresses issues related to the ingress mTLS CA certificate, which is not applicable to the equivalent Apigee Edge documentation.\u003c/p\u003e\n"],["\u003cp\u003eAn \u003ccode\u003eApigeeIssue\u003c/code\u003e with the \u003ccode\u003eReason\u003c/code\u003e \u003ccode\u003eAIS_INGRESS_MTLS_CA_CERT_INVALID\u003c/code\u003e indicates problems with the ingress mTLS CA certificate, which may be due to the certificate not being PEM-encoded or being malformed.\u003c/p\u003e\n"],["\u003cp\u003eThe diagnosis involves using \u003ccode\u003ekubectl\u003c/code\u003e to describe the \u003ccode\u003eApigeeIssue\u003c/code\u003e, which reveals the affected \u003ccode\u003eApigeeRouteConfig\u003c/code\u003e and the Kubernetes secret containing the faulty certificate, along with a detailed error message in \u003ccode\u003eSpec.Details\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eResolution requires identifying the \u003ccode\u003eApigeeRouteConfig\u003c/code\u003e and the corresponding virtual host in the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file, validating the \u003ccode\u003ecaCertPath\u003c/code\u003e file's content using \u003ccode\u003eopenssl\u003c/code\u003e if needed, and correcting the file content to include the required certificate format.\u003c/p\u003e\n"],["\u003cp\u003eIf issues persist, it is necessary to gather detailed diagnostic information, including the Google Cloud Project ID, Apigee hybrid organization name, the \u003ccode\u003eSpec.Details\u003c/code\u003e field of the \u003ccode\u003eApigeeIssue\u003c/code\u003e, and optionally, the \u003ccode\u003ecaCertPath\u003c/code\u003e referenced file, before contacting Google Cloud Customer Care.\u003c/p\u003e\n"]]],[],null,["# Ingress mTLS CA cert invalid\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nThere is no equivalent\n[Apigee Edge](https://docs.apigee.com/api-platform/get-started/get-started) documentation for this topic.*\n| **Note:** This document is applicable for Apigee hybrid users only.\n\n\u003cbr /\u003e\n\nSymptom\n-------\n\n\nAn `ApigeeIssue` with `Reason` `AIS_INGRESS_MTLS_CA_CERT_INVALID`\nis shown when viewing resources in the `apigee` namespace.\n\nError messages\n--------------\n\n\nAfter running `kubectl -n apigee get apigeeissues`, an error like the following is\ndisplayed: \n\n```scdoc\nNAME SEVERITY REASON DOCUMENTATION AGE\nca-cert-invalid-my-org-my-virtualhost ERROR AIS_INGRESS_MTLS_CA_CERT_INVALID https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_MTLS_CA_CERT_INVALID 5h18m\n```\n\nPossible causes\n---------------\n\nCause: Ingress mTLS CA certificate is not PEM-encoded\n-----------------------------------------------------\n\n\nThe ingress mTLS CA certificate stored in the Kubernetes secret referenced by an\n`ApigeeRouteConfig` is missing the PEM-encoding text blocks (or they are malformed).\n\n### Diagnosis\n\n\nRun the following command: \n\n```\nkubectl -n apigee describe apigeeissue ISSUE_NAME\n```\n\n\nWhere \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n`ca-cert-invalid-my-org-my-virtualhost`.\n\n\nThe output should look similar to the following: \n\n```vb.net\nName: ca-cert-invalid-my-org-my-virtualhost\nNamespace: apigee\nLabels: ais-reason=AIS_INGRESS_MTLS_CA_CERT_INVALID\nAnnotations: \u003cnone\u003e\nAPI Version: apigee.cloud.google.com/v1alpha1\nKind: ApigeeIssue\nMetadata:\n Creation Timestamp: 2023-06-12T17:03:43Z\n Generation: 1\n Owner References:\n API Version: apigee.cloud.google.com/v1alpha2\n Kind: ApigeeOrganization\n Name: my-org\n UID: 7e83a52c-ce00-4bed-98be-55835ada1817\n Resource Version: 3281563\n UID: adc775c2-376d-4bf9-9860-500b2b2b8273\nSpec:\n Details: CA certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" is not PEM encoded\n Documentation: https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_MTLS_CA_CERT_INVALID\n Reason: AIS_INGRESS_MTLS_CA_CERT_INVALID\n Severity: ERROR\nEvents: \u003cnone\u003e\n``` \n\n```actionscript-3\nSpec:\n Details: CA certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" is not PEM encoded\n```\n\n\nThe contents of `Spec.Details` explains the name of the\n`ApigeeRouteConfig` that refers to the Kubernetes secret containing the ingress mTLS\nCA certificate which is not PEM-encoded.\n\n### Resolution\n\n1.\n Use `kubectl describe` to display the name of the `ApigeeRouteConfig`\n which has the ingress mTLS CA cert which is not PEM-encoded:\n\n ```\n kubectl -n apigee describe apigeeissue ISSUE_NAME\n ```\n\n\n Where \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n `ca-cert-invalid-my-org-my-virtualhost`.\n\n\n In this example, the `ApigeeRouteConfig` `my-org-my-virtualhost` is\n referencing the secret `my-org-my-virtualhost`.\n2.\n Determine the `virtualhost` name from the `ApigeeRouteConfig`.\n\n\n The `ApigeeRouteConfig`'s name is in the format:\n `\u003cApigee organization\u003e-\u003cvirtualhost name\u003e`.\n\n\n In this example, `my-org` is the Apigee organization and the virtualhost name is\n `my-virtualhost`.\n3. Find the corresponding virtualhost in your `overrides.yaml`.\n\n ```\n virtualhosts:\n ...\n - name: my-virtualhost\n selector:\n app: apigee-ingressgateway\n caCertPath: ./certs/ca.pem\n sslCertPath: ./certs/vhost.pem\n sslKeyPath: ./certs/vhost.key\n ...\n ```\n4.\n Validate the contents of the file provided via the path declared in `caCertPath`.\n Ensure the content contains the required starting and ending certificate blocks. For example:\n\n ```\n -----BEGIN CERTIFICATE-----\n MIIDYTCCAkmgAwIBAgIUSXeU0pQYRFzYlqZpKhNNJdBLFBIwDQYJKoZIhvcNAQEL\n ... \u003ccontents omitted\u003e ...\n eWJyaWQuZTJlLmFwaWdlZWtzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\n MMM=\n -----END CERTIFICATE-----\n ```\n | **Tip:** Use `openssl` to validate the CA certificate.\n5.\n Once the contents and format of the file have been fixed, apply the change to the virtualhost:\n\n ```\n helm upgrade ENV_GROUP_NAME apigee-virtualhost/ \\\n --namespace apigee \\\n --set envgroup=ENV_GROUP_NAME \\\n -f overrides.yaml\n ```\n\nCause: Ingress mTLS CA certificate is malformed\n-----------------------------------------------\n\n\nThe ingress mTLS CA certificate stored in the Kubernetes secret referenced by an\n`ApigeeRouteConfig` is malformed.\n\n### Diagnosis\n\n\nRun the following command: \n\n```\nkubectl -n apigee describe apigeeissue ISSUE_NAME\n```\n\n\nWhere \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n`ca-cert-invalid-my-org-my-virtualhost`.\n\n\nThe output should look similar to the following: \n\n```vb.net\nName: ca-cert-invalid-my-org-my-virtualhost\nNamespace: apigee\nLabels: ais-reason=AIS_INGRESS_MTLS_CA_CERT_INVALID\nAnnotations: \u003cnone\u003e\nAPI Version: apigee.cloud.google.com/v1alpha1\nKind: ApigeeIssue\nMetadata:\n Creation Timestamp: 2023-06-12T17:03:43Z\n Generation: 1\n Owner References:\n API Version: apigee.cloud.google.com/v1alpha2\n Kind: ApigeeOrganization\n Name: my-org\n UID: 7e83a52c-ce00-4bed-98be-55835ada1817\n Resource Version: 3281563\n UID: adc775c2-376d-4bf9-9860-500b2b2b8273\nSpec:\n Details: CA certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" is invalid\n Documentation: https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_MTLS_CA_CERT_INVALID\n Reason: AIS_INGRESS_MTLS_CA_CERT_INVALID\n Severity: ERROR\nEvents: \u003cnone\u003e\n``` \n\n```actionscript-3\nSpec:\n Details: CA certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" is invalid\n```\n\n\nThe contents of `Spec.Details` explains the name of the\n`ApigeeRouteConfig` that refers to the Kubernetes secret containing the ingress mTLS\nCA certificate which is malformed and failed to parse.\n\n### Resolution\n\n1.\n Use `kubectl describe` to display the name of the `ApigeeRouteConfig`\n which has the ingress mTLS CA cert which is malformed:\n\n ```\n kubectl -n apigee describe apigeeissue ISSUE_NAME\n ```\n\n\n Where \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n `ca-cert-invalid-my-org-my-virtualhost`.\n\n\n In this example, the `ApigeeRouteConfig` `my-org-my-virtualhost` is\n referencing the secret `my-org-my-virtualhost`.\n2.\n Determine the `virtualhost` name from the `ApigeeRouteConfig`.\n\n\n The `ApigeeRouteConfig`'s name is in the format:\n `\u003cApigee organization\u003e-\u003cvirtualhost name\u003e`.\n\n\n In this example, `my-org` is the Apigee organization and the virtualhost name is\n `my-virtualhost`.\n3. Find the corresponding virtualhost in your `overrides.yaml`.\n\n ```\n virtualhosts:\n ...\n - name: my-virtualhost\n selector:\n app: apigee-ingressgateway\n caCertPath: ./certs/ca.pem\n sslCertPath: ./certs/vhost.pem\n sslKeyPath: ./certs/vhost.key\n ...\n ```\n4.\n Validate the contents of the file provided via the path declared in `caCertPath`.\n Ensure the contents contain the entire certificate. For example:\n\n ```\n -----BEGIN CERTIFICATE-----\n MIIDYTCCAkmgAwIBAgIUSXeU0pQYRFzYlqZpKhNNJdBLFBIwDQYJKoZIhvcNAQEL\n BQAwQDE+MDwGA1UEAww1bWF4bWlsbGlvbi1oeWJyaWQtc3RhZ2luZy1kZXYuaHli\n ... \u003ccontents omitted\u003e ...\n 0TPPaik8U9dtFXMGT1DJkjPRPO0Jw5rlU8DKlNA/Kkv52aKJZNwB/cwmvoa/BFji\n PIPa9wY=\n -----END CERTIFICATE-----\n ```\n | **Tip:** Use `openssl` to validate the CA certificate.\n5.\n Once the contents and format of the file have been fixed, apply the change to the virtualhost:\n\n ```\n helm upgrade ENV_GROUP_NAME apigee-virtualhost/ \\\n --namespace apigee \\\n --set envgroup=ENV_GROUP_NAME \\\n -f overrides.yaml\n ```\n\nMust gather diagnostic information\n----------------------------------\n\n\nIf the problem persists even after following the above instructions, gather\nthe following diagnostic information and then contact [Google Cloud Customer Care](https://cloud.google.com/support-hub/):\n\n1. The Google Cloud Project ID.\n2. The name of the Apigee hybrid organization.\n3. The `Spec.Details` field of the `ApigeeIssue`.\n4. (optional) File referenced by `caCertPath` for the affected virtualhost."]]
