<p>There are three ways, all should return the same output. If they are not, something is wrong.</p>
<p>All of this assumes Unix-y shell, and jq, base64, openssl installed. The secret is in <code>cert-certname</code>, the website (assuming this protects a website) is at <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a></p>
<p>1.</p>
<pre><code>kubectl get secret cert-certname -o json  | jq -r '.data.&quot;tls.crt&quot;' | base64 -d &gt; tls.crt
openssl x509 -inform pem -in tls.crt -pubkey -noout
</code></pre>
<ol start="2">
<li></li>
</ol>
<pre><code>kubectl get secret cert-certname -o json  | jq -r '.data.&quot;tls.key&quot;' | base64 -d &gt; tls.key
openssl rsa -in tls.key -pubout
</code></pre>
<ol start="3">
<li></li>
</ol>
<pre><code>openssl s_client -connect example.com:443 | openssl x509 -pubkey -noout
</code></pre>
<p>Note that 1) and 2) creates files containing secrets on your disk; you should delete them afterwards. And never ever put them to git or similar version control.</p>

CC BY-SA 4.0
2021-09-13T05:53:42.137Z
2021-09-13T05:53:42.137Z
Karel Bílek
<p>I need to get a public key from cert manager from bash. How to do it properly?</p>
<p>I can see the private key in kubernetes secrets; how to get public key that can be safely shared?</p>

<kubernetes><kubectl><cert-manager>
How to get public key from cert-manager?
Karel Bílek
# How to get public key from cert-manager?

(Asked by: username_0 on 2021-09-13)

I need to get a public key from cert manager from bash. How to do it properly?

I can see the private key in kubernetes secrets; how to get public key that can be safely shared?

**Tags:** kubernetes, kubectl, cert-manager


---

## 1 answers

### Answer by username_0 on 2021-09-13. Score: 0 | Accepted answer

There are three ways, all should return the same output. If they are not, something is wrong.
All of this assumes Unix-y shell, and jq, base64, openssl installed. The secret is in cert-certname, the website (assuming this protects a website) is at https://example.com
1.
kubectl get secret cert-certname -o json  | jq -r '.data."tls.crt"' | base64 -d > tls.crt
openssl x509 -inform pem -in tls.crt -pubkey -noout




kubectl get secret cert-certname -o json  | jq -r '.data."tls.key"' | base64 -d > tls.key
openssl rsa -in tls.key -pubout




openssl s_client -connect example.com:443 | openssl x509 -pubkey -noout

Note that 1) and 2) creates files containing secrets on your disk; you should delete them afterwards. And never ever put them to git or similar version control.


---

