1

I', trying to configure a cert-manager in a Baremetal server. I followed this link & this one

the k describe challenge my-domain.com-xqwh4-4005106243-2059835058

get

Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
  State:       pending
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Started    2m27s  cert-manager  Challenge scheduled for processing
  Normal  Presented  2m26s  cert-manager  Presented challenge using HTTP-01 challenge mechanism

the k describe order my-domain.com-xqwh4-4005106243 has State: pending

the k describe certificate my-domain.com

Status:
  Conditions:
    Last Transition Time:        2021-10-11T01:30:50Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2021-10-11T01:30:50Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing

If a call directly the http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow it works well

Any idea how to troubleshoot it? I tried all the things from https://cert-manager.io/docs/faq/troubleshooting/

the cert ingress

kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: cm-acme-http-solver-plvqx
  generateName: cm-acme-http-solver-
  namespace: default
  uid: 9a9f6829-3b89-4990-9038-f45285a4ae92
  resourceVersion: '3155628'
  generation: 1
  creationTimestamp: '2021-10-11T01:30:52Z'
  labels:
    acme.cert-manager.io/http-domain: '1019414173'
    acme.cert-manager.io/http-token: '902303313'
    acme.cert-manager.io/http01-solver: 'true'
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  ownerReferences:
    - apiVersion: acme.cert-manager.io/v1
      kind: Challenge
      name: my-domain.com-xqwh4-4005106243-2059835058
      uid: 03bd05a0-d39d-4377-ad2a-43963b4ea9b9
      controller: true
      blockOwnerDeletion: true
  managedFields:
    - manager: controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2021-10-11T01:30:52Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:nginx.ingress.kubernetes.io/whitelist-source-range: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:acme.cert-manager.io/http-domain: {}
            f:acme.cert-manager.io/http-token: {}
            f:acme.cert-manager.io/http01-solver: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"03bd05a0-d39d-4377-ad2a-43963b4ea9b9"}: {}
        f:spec:
          f:ingressClassName: {}
          f:rules: {}
    - manager: nginx-ingress-controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2021-10-11T01:31:13Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:loadBalancer:
            f:ingress: {}
      subresource: status
spec:
  ingressClassName: nginx
  rules:
    - host: my-domain.com
      http:
        paths:
          - path: >-
              /.well-known/acme-challenge/mIHD-FglhGgu-QV-NSMHzTtTCneahED5Ns7HpTfABow
            pathType: ImplementationSpecific
            backend:
              service:
                name: cm-acme-http-solver-22qx2
                port:
                  number: 8089
status:
  loadBalancer:
    ingress:
      - ip: 137.100.90.100
3
  • What version of cert manager are you using? Can you share nginx/htaccess configuration?
    – Kyslik
    Oct 15 at 12:35
  • v1.5.4. ingress edited bellow
    – Math
    Oct 16 at 14:23
  • tried with 1.6 but the same. posted too stackoverflow.com/questions/69780209/…
    – Math
    Oct 30 at 13:50
0

I have less reputation to add this in comment, are you sure your domain.com is resolving to said IP, ,and any .htacess or any rule preventing it, sometimes it take time to resolve and it route to old domain.com

10
  • if I ping my domain, resolve the correct IP. But how can I check the whole flow manually? maybe from inside a pod? (Sorry I'm not a devop, so my K experience is too little)
    – Math
    Oct 11 at 15:41
  • you can login to pod? Oct 11 at 16:13
  • nop, no bash, sh :(
    – Math
    Oct 12 at 1:28
  • on bare metal there can be many reasons, my suggestion is to try docker cert manager and see if all working fine Oct 12 at 3:54
  • ok, I can try that. At least there are some steps to try to see what's happens?
    – Math
    Oct 12 at 12:30
0

Thanks for all the help. the Issue was solved with a workaround https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841

basically the cert manager pod was unable to access the service pod. Seems a dns or something blocking the http call, redirecting to https and the cert-manager fails

So to avoid go-out and go-in again

k -n cert-manager edit deployment cert-manager

and add in spec

spec:
  ...
  hostAliases:
    - hostnames:
      - something-do.com
      ip: 138.178.91.111 # server IP

this will add that line to the /etc/hosts so will call directly to your service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.