Skip to main content

Accessing sandbox-manager via E2B Protocol with Self-Signed Certificates

This document provides a best practice for accessing sandbox-manager via self-signed certificates, including how to create certificates through an optimized script, how to install certificates in the cluster, and how to configure the E2B client.

note

If your deployment uses the Helm charts together with cert-manager, you can skip the manual certificate steps below: with enableTLS=true on both charts, cert-manager issues the ingress certificate directly into the sandbox-manager-tls Secret and trust-manager distributes the shared CA. See Managing sandbox-manager Self-Signed Certificates with cert-manager for the chart-native workflow.

Prerequisites​

  1. sandbox-manager is installed in the cluster
  2. Ensure the sandbox-manager ingress is active (has an entrypoint). You can confirm this using the following command. The Address column should not be empty:
$ kubectl get ingress sandbox-manager -n sandbox-system

Step 1: Create Certificates​

Create self-signed certificates using the script generate-certificate.sh. You can view the script usage with the following command.

$ bash generate-certificates.sh --help

Usage: generate-certificates.sh [OPTIONS]

Options:
  -d, --domain DOMAIN     Add a base domain; may be specified multiple times
                          DOMAIN and *.DOMAIN will both be added
  -o, --output DIR        Specify output directory (default: .)
  -D, --days DAYS         Specify certificate validity days (default: 365)
      --ca-key PATH       Reuse an existing CA private key
      --ca-cert PATH      Reuse the matching existing CA certificate; it must
                          be authorized to sign and valid for --days
  -h, --help              Show this help message

Examples:
  generate-certificates.sh -d example1.com -d example2.com
  generate-certificates.sh --domain example1.com --domain example2.com --days 730
  generate-certificates.sh -d example.com --ca-key ca-key.pem --ca-cert ca-cert.pem

After completing certificate generation, you will obtain the following files:

  • fullchain.pem: Server certificate public key
  • privkey.pem: Server certificate private key
  • ca-fullchain.pem: CA certificate public key
  • ca-privkey.pem: CA certificate private key

For every base domain passed with --domain, the script adds both the base domain and its wildcard name to the certificate SANs. For example, -d example1.com -d example2.com covers example1.com, *.example1.com, example2.com, and *.example2.com. This supports multiple native and private E2B endpoints served by the same sandbox-manager.

By default, each run creates a new CA. To issue another server certificate from the same trust root, pass the existing CA key and certificate together with --ca-key and --ca-cert. The CA must be valid for the requested lifetime and authorized to sign certificates.

Step 2: Install Certificates​

Mount the server certificate to the cluster's Ingress using the following command:

$ kubectl create secret tls sandbox-manager-tls \
          --cert=fullchain.pem \
          --key=privkey.pem -n sandbox-system

Certificate activation may have some delay, depending on your ingress controller's efficiency.

Step 3: Configure Client Trust​

The client needs to set the environment variable SSL_CERT_FILE to the path of the CA public key file ( ca-fullchain.pem) generated in Step 1:

$ export SSL_CERT_FILE=/path/to/ca-fullchain.pem