16

I'm running into an issue handling tls certificates with cert-manager, I'm following the documentation and added some extras to work with Traefik as an ingress.

Currently, I have this YAML files:

cluster-issuer.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: secure-alexguedescom
spec:
  acme:
    email: user@gmail.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource used to store the account's private key.
      name: letsencrypt-staging
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
      - selector: {}
        http01:
          ingress:
            class: traefik-cert-manager

traefik-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    # add an annotation indicating the issuer to use.
    cert-manager.io/cluster-issuer: letsencrypt-staging
  name: secure-alexguedescom-ingress-http
  namespace: secure-alexguedescom
spec:
  rules:
  - host: secure.alexguedes.com
    http:
      paths:
      - backend:
          serviceName: secure-alexguedescom-nginx
          servicePort: 80
        path: /
  tls: 
  - hosts:
    - secure.alexguedes.com
    secretName: secure-alexguedescom-cert

cert-staging.yaml

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: secure-alexguedescom-cert
  namespace: secure-alexguedescom
spec:
  commonName: secure.alexguedes.com
  secretName: letsencrypt-staging
  dnsNames:
    - secure.alexguedes.com
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer

Inspecting the certs I have this error message:

Message: Issuing certificate as Secret does not contain a certificate
Reason: MissingData

Also inspecting the certificaterequest I have this log messages:

Status:
  Conditions:
    Last Transition Time:  2020-08-16T00:32:01Z
    Message:               Waiting on certificate issuance from order secure-alexguedescom/secure-alexguedescom-cert-q8w5p-1982372682: "pending"
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  OrderCreated  11m   cert-manager  Created Order resource secure-alexguedescom/secure-alexguedescom-cert-q8w5p-1982372682
  Normal  OrderPending  11m   cert-manager  Waiting on certificate issuance from order secure-alexguedescom/secure-alexguedescom-cert-q8w5p-1982372682: ""

I'm not sure which piece is wrong, using Helm v2 with Tiller and k8s v1.7

Any ideas?

Thanks in advance

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
maudev
  • 974
  • 1
  • 14
  • 32
  • I experienced the same problem, but my ingress has configured basic authentication for "/" path. ACME was not able to reach .well-known URI and cannot validate my site. When I removed it, the problem disappeared. – 32cupo Oct 22 '20 at 13:55

1 Answers1

15

The typical problem with letsencrypt certs is the letsencrypt itself not being able to validate who you are and that you own the domain. In this case, alexguedes.com.

With cert-manager you can do Domain Validation and HTTP Validation. Based on the posted ClusterIssuer you are doing HTTP Validation. So you need to make sure that secure.alexguedes.com resolves to a globally available IP address and that Traefik port 443 is listening on that IP address.

Rico
  • 58,485
  • 12
  • 111
  • 141
  • 1
    Thanks for reply, seems to be a problem with Traefik, since we can't ping the external IP provided for the LB, so I'm moving to use nginx ingress controller and LB and hopefully it will be solved – maudev Aug 17 '20 at 20:20
  • 1
    Good to hear. If the answer is satisfactory, can you accept it? Thanks – Rico Aug 17 '20 at 20:31
  • This was helpful thanks. I had to add a record witht the ingress external ip for all the list of hosts in the ingress in the DNS provider, and only then did the certicate issue properly. – zakaria amine Dec 30 '20 at 12:28
  • 8
    @zakariaamine : giving more information about that last step would have been very useful to others.... :| – Orabîg May 26 '21 at 19:34