Usekubectl describe to display the name of theApigeeRouteConfig which has the mismatched ingress cert and key:

kubectl -n apigee describe apigeeissueISSUE_NAME

WhereISSUE_NAME is the name of the issue. For example,ingress-cert-mismatch-my-org-my-virtualhost.

In this example, theApigeeRouteConfigmy-org-my-virtualhost is referencing the secretmy-org-my-virtualhost.

Determine thevirtualhost name from theApigeeRouteConfig.

TheApigeeRouteConfig's name is in the format:<Apigee organization>-<virtualhost name>.

In this example,my-org is the Apigee organization and the virtualhost name ismy-virtualhost.

Find the corresponding virtualhost in youroverrides.yaml file:

virtualhosts:...- name: my-virtualhost  selector:    app: apigee-ingressgateway  sslCertPath: ./certs/vhost.pem  sslKeyPath: ./certs/vhost.key...

Validate that the certificate and key files being used match.

Using thesslCertPath andsslKeyPath from the previous step, validate the MD5 sums match usingopenssl:

openssl x509 -noout -modulus -inSSL_CERT_PATH | openssl md5

openssl rsa -noout -modulus -inSSL_KEY_PATH | openssl md5

• WhereSSL_CERT_PATH is thesslCertPath from the previous step. For example,./certs/vhost.pem.
• WhereSSL_KEY_PATH is thesslKeyPath from the previous step. For example,./certs/vhost.key.

The output of the above two commands should match:

openssl x509 -noout -modulus -in ./certs/vhost.pem | openssl md5MD5(stdin)= 40ba189dbe9d6fbfbdde1a8ef803d2d4

openssl rsa -noout -modulus -in ./certs/vhost.key | openssl md5MD5(stdin)= 40ba189dbe9d6fbfbdde1a8ef803d2d4

If the output from the previous commands did not match, use one of the following methods to correct the problem:

• Update the virtualhost'ssslCertPath andsslKeyPath to point to the correct file paths.
• Fix thesslCertPath orsslKeyPath file contents to contain the correct matching certificate and key pair.