val keyManager =
        newKeyManager(
          null,
          serverCert,
          serverIntermediateCa.certificate,
        )
      val trustManager =
        newTrustManager(
          null,
          Arrays.asList(serverRootCa.certificate, clientRootCa.certificate),
          emptyList(),
        )
      val sslContext = SSLContext.getInstance("TLS")
      sslContext.init(

- Kubeadm: add support for certificate chain validation. When using kubeadm in external CA mode, this allows an intermediate CA to be used to sign the certificates. The intermediate CA certificate must be appended to each signed certificate for this to work correctly. ([#97266](https://github.com/kubernetes/kubernetes/pull/97266), [@robbiemcmichael](https://github.com/robbiemcmichael))...

	public final fun check (Ljava/lang/String;[Ljava/security/cert/Certificate;)V
	public fun equals (Ljava/lang/Object;)Z
	public final fun findMatchingPins (Ljava/lang/String;)Ljava/util/List;
	public final fun getPins ()Ljava/util/Set;
	public fun hashCode ()I
	public static final fun pin (Ljava/security/cert/Certificate;)Ljava/lang/String;

<img src="/img/deployment/https/https08.drawio.svg">

そうすれば、TLS Termination Proxy は、**複数のドメイン**や複数のアプリケーションのHTTPSと証明書を処理し、それぞれのケースで適切なアプリケーションにリクエストを送信することができます。

### 証明書の更新 { #certificate-renewal }

将来のある時点で、各証明書は（取得後約3ヶ月で）**失効**します。

その後、Let's Encryptと通信する別のプログラム（別のプログラムである場合もあれば、同じTLS Termination Proxyである場合もある）によって、証明書を更新します。

<img src="/img/deployment/https/https.drawio.svg">

  - `status.conditions[*].status` is now required
  - `status.certificate` must be PEM-encoded, and contain only CERTIFICATE blocks ([#91685](https://github.com/kubernetes/kubernetes/pull/91685), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Architecture, Auth, CLI and Testing]

        .build()
    val handshakeCertificates =
      HandshakeCertificates
        .Builder()
        .heldCertificate(heldCertificate)
        .addTrustedCertificate(heldCertificate.certificate)
        .build()
    server.useHttps(handshakeCertificates.sslSocketFactory())

    val dns =
      Dns {
        Dns.SYSTEM.lookup(server.hostName)
      }

    val client =

- When `--rotate-server-certificates` is enabled, kubelet will no longer request a new certificate on startup if the current certificate on disk is satisfactory. ([#69991](https://github.com/kubernetes/kubernetes/pull/69991), [@agunnerson-ibm](https://github.com/agunnerson-ibm))

pkg crypto/tls, method (*Conn) Write([]uint8) (int, error)
pkg crypto/tls, type Certificate struct
pkg crypto/tls, type Certificate struct, Certificate [][]uint8
pkg crypto/tls, type Certificate struct, Leaf *x509.Certificate
pkg crypto/tls, type Certificate struct, OCSPStaple []uint8
pkg crypto/tls, type Certificate struct, PrivateKey crypto.PrivateKey
pkg crypto/tls, type ClientAuthType int

		defer cancel()
		transport, err := s.NewHTTPTransportWithClientCerts(ctx, clientCert, clientKey)
		if err != nil {
			internalLogIf(ctx, fmt.Errorf("Unable to load client key and cert, please check your client certificate configuration: %w", err))
		}
		if transport == nil {
			// Client certs are not readable return default transport.
			return s.NewHTTPTransportWithTimeout(1 * time.Minute)
		}
		return transport
	}

				"application/vnd.airzip.filesecure.azs",
				"application/vnd.amazon.ebook",
				"application/vnd.americandynamics.acc",
				"application/vnd.amiga.ami",
				"application/vnd.anser-web-certificate-issue-initiation",
				"application/vnd.anser-web-funds-transfer-initiation",
				"application/vnd.antix.game-component",
				"application/vnd.apple.installer+xml",
				"application/vnd.apple.iwork",