Cert-Manager dns01 challenge order pending

Question

Followed steps mentioned at https://cert-manager.io/docs/installation/kubernetes/

# Kubernetes 1.16+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.3/cert-manager.yaml


$ kubectl -n cert-manager get pods
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-958cb7d4d-m62xm               1/1     Running   0          137m
cert-manager-cainjector-8495f7f6c9-56ck6   1/1     Running   0          137m
cert-manager-webhook-5dcdfbd9d4-6mw74      1/1     Running   0          137m

ClusterIssuer

% kubectl -n cert-manager describe ClusterIssuer letsencrypt
Name:         letsencrypt
Namespace:
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"cert-manager.io/v1alpha2","kind":"ClusterIssuer","metadata":{"annotations":{},"name":"letsencrypt"},"spec":{"acme":{"email"...
API Version:  cert-manager.io/v1
Kind:         ClusterIssuer
Metadata:
  Creation Timestamp:  2020-10-21T17:31:16Z
  Generation:          1
  Resource Version:    120254050
  Self Link:           /apis/cert-manager.io/v1/clusterissuers/letsencrypt
  UID:                 fe54ce07-61be-446f-9db1-4745b742ac71
Spec:
  Acme:
    Email:            admin@example.com
    Preferred Chain:
    Private Key Secret Ref:
      Name:  letsencrypt-test-key
    Server:  https://acme-v02.api.letsencrypt.org/directory
    Solvers:
      dns01:
        route53:
          Access Key ID:   ####
          Hosted Zone ID:  ####
          Region:          us-west-2
          Secret Access Key Secret Ref:
            Key:   secret_key
            Name:  aws-secret
      Selector:
        Dns Zones:
          example.com
Status:
  Acme:
    Last Registered Email:  admin@example.com
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/98054390
  Conditions:
    Last Transition Time:  2020-10-21T17:31:16Z
    Message:               The ACME account was registered with the ACME server
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

Certificate

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: test-cert
  namespace: cert-manager
spec:
  commonName: '*.test.example.com'
  secretName: test-cert
  dnsNames:
    - '*.test.example.com'
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer


$ kubectl -n cert-manager get certificate
NAME        READY   SECRET      AGE
test-cert   False   test-cert   65m


$ kubectl -n cert-manager describe certificate test-cert
Name:         test-cert
Namespace:    cert-manager
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"test-cert","namespace":"cert-manager"},...
API Version:  cert-manager.io/v1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-10-21T17:31:23Z
  Generation:          1
  Resource Version:    120254080
  Self Link:           /apis/cert-manager.io/v1/namespaces/cert-manager/certificates/test-cert
  UID:                 82148eee-5f4b-47d7-a09a-407e4d041101
Spec:
  Common Name:  *.test.example.com
  Dns Names:
    *.test.example.com
  Issuer Ref:
    Kind:       ClusterIssuer
    Name:       letsencrypt
  Secret Name:  test-cert
Status:
  Conditions:
    Last Transition Time:        2020-10-21T17:31:23Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2020-10-21T17:31:23Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  test-cert-gqhmj

CertificateRequest

  $ kubectl -n cert-manager get CertificateRequest
  NAME              READY   AGE
  test-cert-zqbwz   False   67m

  $ kubectl -n cert-manager describe CertificateRequest test-cert-zqbwz
  Name:         test-cert-zqbwz
  Namespace:    cert-manager
  Labels:       <none>
  Annotations:  cert-manager.io/certificate-name: test-cert
                cert-manager.io/certificate-revision: 1
                cert-manager.io/private-key-secret-name: test-cert-gqhmj
                kubectl.kubernetes.io/last-applied-configuration:
                  {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"test-cert","namespace":"cert-manager"},...
  API Version:  cert-manager.io/v1
  Kind:         CertificateRequest
  Metadata:
    Creation Timestamp:  2020-10-21T17:31:24Z
    Generate Name:       test-cert-
    Generation:          1
    Owner References:
      API Version:           cert-manager.io/v1
      Block Owner Deletion:  true
      Controller:            true
      Kind:                  Certificate
      Name:                  test-cert
      UID:                   82148eee-5f4b-47d7-a09a-407e4d041101
    Resource Version:        120254090
    Self Link:               /apis/cert-manager.io/v1/namespaces/cert-manager/certificaterequests/test-cert-zqbwz
    UID:                     bb9d218d-084d-40a5-8f83-46ca5ac4f70a
  Spec:
    Issuer Ref:
      Kind:   ClusterIssuer
      Name:   letsencrypt
    Request:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSR...Q0FURSBSRVFVRVNULS0tLS0K
  Status:
    Conditions:
      Last Transition Time:  2020-10-21T17:31:24Z
      Message:               Waiting on certificate issuance from order cert-manager/test-cert-zqbwz-2027085711: "pending"
      Reason:                Pending
      Status:                False
      Type:                  Ready
  Events:                    <none>

Order :

  $ kubectl -n cert-manager get order
  NAME                         STATE     AGE
  test-cert-zqbwz-2027085711   pending   68m

  $ kubectl -n cert-manager describe order test-cert-zqbwz-2027085711
  Name:         test-cert-zqbwz-2027085711
  Namespace:    cert-manager
  Labels:       <none>
  Annotations:  cert-manager.io/certificate-name: test-cert
                cert-manager.io/certificate-revision: 1
                cert-manager.io/private-key-secret-name: test-cert-gqhmj
                kubectl.kubernetes.io/last-applied-configuration:
                  {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"test-cert","namespace":"cert-manager"},...
  API Version:  acme.cert-manager.io/v1
  Kind:         Order
  Metadata:
    Creation Timestamp:  2020-10-21T17:31:24Z
    Generation:          1
    Owner References:
      API Version:           cert-manager.io/v1
      Block Owner Deletion:  true
      Controller:            true
      Kind:                  CertificateRequest
      Name:                  test-cert-zqbwz
      UID:                   bb9d218d-084d-40a5-8f83-46ca5ac4f70a
    Resource Version:        120254091
    Self Link:               /apis/acme.cert-manager.io/v1/namespaces/cert-manager/orders/test-cert-zqbwz-2027085711
    UID:                     622c3ce4-fa2f-484f-a280-c125e09e37d3
  Spec:
    Common Name:  *.test.example.com
    Dns Names:
      *.test.example.com
    Issuer Ref:
      Kind:   ClusterIssuer
      Name:   letsencrypt
    Request:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBS...USUZJQ0FURSBSRVFVRVNULS0tLS0K
  Status:
    Authorizations:
      Challenges:
        Token:        QCbSEvy4g6wIHpcOyU4UkIES9TtBoKMuOOyYNVsJ13w
        Type:         dns-01
        URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/8048950916/RQu94g
      Identifier:     test.example.com
      Initial State:  pending
      URL:            https://acme-v02.api.letsencrypt.org/acme/authz-v3/8048950916
      Wildcard:       true
    Finalize URL:     https://acme-v02.api.letsencrypt.org/acme/finalize/68054360/5803374286
    State:            pending
    URL:              https://acme-v02.api.letsencrypt.org/acme/order/68054360/5803374286
  Events:             <none>
Events:                          <none>

Why certificate order is pending state, in Route53 I do see TXT for _acme-challenge.test.example.com is created

Whats I am missing in my setup here ?

The above cited approach worked for me with Nginx, tls-cert is automatically generated in the intended namespace, the key and certificate both. For this to happen, you should point the IP of nginx loadbalancer to DNS It worked for me, the acme challenge will get auto tested and the certificate will change it status from false to true, once this gets done — Tushar Mahajan, Sep 29 '20 at 06:52
the tls-cert secret was created by cert-manager itself for the namespace for which I created the ingress rule. Are you doing anything different from this — Tushar Mahajan, Sep 29 '20 at 06:53
Nope, I even created test app, still certificate was not generated. — roy, Sep 29 '20 at 14:55
just a suggestion, can you just try creating helm chart in some other namespace, and look for any Kubernetes object files those are generated there and maybe you would be missing any of them in your current namespace. Then you can remove that helm chart deployment after figuring out things. — Tushar Mahajan, Sep 30 '20 at 05:27
tried helm as well, same result. Added CertificateRequest to question. — roy, Sep 30 '20 at 18:58

Emre Odabaş · Answer 1 · 2020-10-08T19:09:14.857

1

Probably the same situation

Waiting on certificate issuance from order status "pending"

edited Oct 08 '20 at 19:09

answered Oct 08 '20 at 07:57

Emre Odabaş

409
3
6

Sorry, I corrected my command as your previous outputs. – Emre Odabaş Oct 08 '20 at 16:31
My command is not get certificate, Kubectl certificate approve – Emre Odabaş Oct 08 '20 at 18:47
$ kubectl -n cert-manager certificate approve test-cert-2glmx No resources found Error from server (NotFound): certificatesigningrequests.certificates.k8s.io "test-cert-2glmx" not found – roy Oct 08 '20 at 18:48
What is your kubectl get csr -n cert-manager output ? – Emre Odabaş Oct 08 '20 at 18:50
% kubectl -n cert-manager get certificate NAME READY SECRET AGE test-cert False test-cert 161m – roy Oct 08 '20 at 18:51
kubectl certificate approve test-cert -n cert-manager – Emre Odabaş Oct 08 '20 at 18:52
$ kubectl -n cert-manager certificate approve test-cert No resources found Error from server (NotFound): certificatesigningrequests.certificates.k8s.io "test-cert" not found – roy Oct 08 '20 at 18:54
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/222737/discussion-between-emre-odabas-and-roy). – Emre Odabaş Oct 08 '20 at 18:55

Cert-Manager dns01 challenge order pending

1 Answers1