1

I'm attempting to deploy a Kubernetes cluster with an SSL certificate using LetsEncrypt on DigitalOcean. I followed these instructions, and everything works right up until the challenge order is created by the ClusterIssuer. Then I get this error:

cert-manager/controller/orders "msg"="Failed to determine the list of Challenge resources needed for the Order" "error"="no configured challenge solvers can be used for this challenge" "resource_kind"="Order" "resource_name"="letsencrypt-prod-cert-458163912-1173127706"

I've tried it both with http, and trying to configure DigitalOcean's dns01 resolver, but neither work, and with a similar error. The site is live by ip, by dns name (though I get the no-ssl cert warning). This is the ClusterIssuer description:

Name:         letsencrypt-issuer
Namespace:
Labels:       app/instance=webapp
              app/managed-by=Tiller
              app/name=webapp
              app/version=0.1.0
              helm.sh/chart=webapp-0.1.0
Annotations:  cert-manager.io/cluster-issuer: letsencrypt-issuer
              kubernetes.io/ingress.class: nginx
              kubernetes.io/tls-acme: true
API Version:  cert-manager.io/v1alpha2
Kind:         ClusterIssuer
Metadata:
  Creation Timestamp:  2019-10-16T23:24:47Z
  Generation:          2
  Resource Version:    10300992
  Self Link:           /apis/cert-manager.io/v1alpha2/clusterissuers/letsencrypt-issuer
  UID:                 2ee08cd4-5781-4126-9e6d-6b9d108a1eb2
Spec:
  Acme:
    Email:  <redacted>
    Private Key Secret Ref:
      Name:  letsencrypt-prod-cert
    Server:  https://acme-v02.api.letsencrypt.org/directory
Status:
  Acme:
    Last Registered Email:  <redacted>
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/69503670
  Conditions:
    Last Transition Time:  2019-10-16T23:24:48Z
    Message:               The ACME account was registered with the ACME server
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

Is there a way to see the solvers themselves to validate they're configured correctly? Is there a way to exercise them to prove they work? Is there some other way to diagnose what the situation is? I'm completely stuck, as there doesn't seem to be a lot of support online for this?

4
  • The acme challenge has to be fulfilled for this validation, have a look at this for more info Oct 17, 2019 at 1:41
  • @TusharMahajan I have looked at that. Alas, it is not succeeding because of the above issue. Notably, that page has a big 'ol TODO where it says 'Troubleshooting failing challenges', which is why I've come here to SO. :/ Oct 17, 2019 at 3:46
  • Hi Nathaniel, I just implemented this TLS implementation via jetstack but I haven't used acme challenge for it, as my certificate got issued without that only and I have implemented it with kubernetes only. Shall I share the approach to get the TLS encryption ? Oct 17, 2019 at 11:26
  • My acme challenge got solved at level of ingress rule only. I can share details Oct 17, 2019 at 14:52

1 Answer 1

14
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
 metadata:
  name: certificate-name
spec:
  secretName: tls-cert
  duration: 24h
  renewBefore: 12h
  commonName: hostname
  dnsNames:
  - hostname
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer

apiVersion: certmanager.k8s.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-private-key
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress:
          class: nginx
      selector: {}

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/acme-challenge-type: http01
    certmanager.k8s.io/cluster-issuer: letsencrypt
  name: ingress-rule
  namespace: default
spec:
  rules:
  - host: hostname
    http:
      paths:
      - backend:
          serviceName: backend-service
          servicePort: 8080
  tls:
  - hosts:
    - hostname
    secretName: tls-cert

The above cited approach worked for me, tls-cert is automatically generated in the intended namespace, the key and certificate both. For this to happen, you should point the IP of nginx loadbalancer to DNS

It worked for me, the acme challenge will get auto tested and the certificate will change it status from false to true, once this gets done

6
  • Can you explain that last sentence about the IP of the nginx loadbalancer? What do you mean by 'point it to the DNS'? Oct 17, 2019 at 16:59
  • In kubernetes, you would be exposing nginx controller to Load balancer and the externalIP has to be mapped to the hostname, I do that in azure in a service called DNS zone Oct 17, 2019 at 17:20
  • Oh, I see; yes, the DNS is pointed to the Load Balancer's external port. Oct 17, 2019 at 17:21
  • Brilliant! This worked; specifically it looked like the solver stanza was incorrect, and I needed to have an http01 block both there and as an immediate child of acme. Thanks so much!!! Oct 17, 2019 at 17:31
  • 2
    After recent cert-manager update to v.0.11 http01 is moved to solvers. Also both API and API group were changed.
    – Jaded
    Dec 27, 2019 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.