{"action":"created","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/913","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/913/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/913/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/913/events","html_url":"https://github.com/jetstack/cert-manager/issues/913","id":360800565,"node_id":"MDU6SXNzdWUzNjA4MDA1NjU=","number":913,"title":"acme: authorization for identifier is invalid","user":{"login":"discostur","id":2615420,"node_id":"MDQ6VXNlcjI2MTU0MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/2615420?v=4","gravatar_id":"","url":"https://api.github.com/users/discostur","html_url":"https://github.com/discostur","followers_url":"https://api.github.com/users/discostur/followers","following_url":"https://api.github.com/users/discostur/following{/other_user}","gists_url":"https://api.github.com/users/discostur/gists{/gist_id}","starred_url":"https://api.github.com/users/discostur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/discostur/subscriptions","organizations_url":"https://api.github.com/users/discostur/orgs","repos_url":"https://api.github.com/users/discostur/repos","events_url":"https://api.github.com/users/discostur/events{/privacy}","received_events_url":"https://api.github.com/users/discostur/received_events","type":"User","site_admin":false},"labels":[{"id":728658048,"node_id":"MDU6TGFiZWw3Mjg2NTgwNDg=","url":"https://api.github.com/repos/jetstack/cert-manager/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-17T10:09:38Z","updated_at":"2018-10-08T10:45:01Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**:\r\nTrying to get a a letsencrypt certificate via cert-manager but always getting the following error:\r\n\r\n```\r\nacme: authorization for identifier cafe.example.com is invalid\r\n``` \r\n\r\nHere is the full log output from cert-manager:\r\n```\r\nI0917 09:58:26.865414       1 prepare.go:488] Accepting challenge for domain \"cafe.example.com\"\r\nI0917 09:58:26.865469       1 logger.go:63] Calling AcceptChallenge\r\nI0917 09:58:27.586322       1 prepare.go:500] Waiting for authorization for domain \"cafe.example.com\"\r\nI0917 09:58:27.586368       1 logger.go:78] Calling WaitAuthorization\r\nI0917 09:58:34.435711       1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt-production'\r\nE0917 09:58:34.435777       1 controller.go:170] issuer \"letsencrypt-production\" in work queue no longer exists\r\nI0917 09:58:34.435810       1 controller.go:154] clusterissuers controller: Finished processing work item \"letsencrypt-production\"\r\nI0917 09:58:38.360355       1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt-production'\r\nI0917 09:58:38.360686       1 logger.go:88] Calling GetAccount\r\nI0917 09:58:39.137147       1 setup.go:93] letsencrypt-production: verified existing registration with ACME server\r\nI0917 09:58:39.137196       1 helpers.go:147] Setting lastTransitionTime for ClusterIssuer \"letsencrypt-production\" condition \"Ready\" to 2018-09-17 09:58:39.137188475 +0000 UTC m=+1613.041914901\r\nI0917 09:58:39.143144       1 controller.go:154] clusterissuers controller: Finished processing work item \"letsencrypt-production\"\r\nI0917 09:58:39.152763       1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt-production'\r\nI0917 09:58:39.153016       1 logger.go:88] Calling GetAccount\r\nI0917 09:58:39.925087       1 setup.go:93] letsencrypt-production: verified existing registration with ACME server\r\nI0917 09:58:39.925187       1 controller.go:154] clusterissuers controller: Finished processing work item \"letsencrypt-production\"\r\nI0917 09:58:44.941148       1 helpers.go:201] Found status change for Certificate \"cafe-secret\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-17 09:58:44.941132175 +0000 UTC m=+1618.845858621\r\nI0917 09:58:44.941208       1 sync.go:276] Error preparing issuer for certificate default/cafe-secret: acme: authorization for identifier cafe.example.com is invalid\r\nE0917 09:58:44.941242       1 sync.go:197] [default/cafe-secret] Error getting certificate 'cafe-secret': secret \"cafe-secret\" not found\r\nI0917 09:58:44.948056       1 controller.go:168] ingress-shim controller: syncing item 'default/cafe-ingress'\r\nI0917 09:58:44.948139       1 sync.go:140] Certificate \"cafe-secret\" for ingress \"cafe-ingress\" already exists\r\nI0917 09:58:44.948198       1 sync.go:143] Certificate \"cafe-secret\" for ingress \"cafe-ingress\" is up to date\r\nI0917 09:58:44.948227       1 controller.go:182] ingress-shim controller: Finished processing work item \"default/cafe-ingress\"\r\nE0917 09:58:44.948498       1 controller.go:180] certificates controller: Re-queuing item \"default/cafe-secret\" due to error processing: acme: authorization for identifier cafe.example.com is invalid\r\nI0917 09:59:07.306583       1 controller.go:168] ingress-shim controller: syncing item 'default/cm-acme-http-solver-khgj4'\r\nI0917 09:59:07.306684       1 sync.go:65] Not syncing ingress default/cm-acme-http-solver-khgj4 as it does not contain necessary annotations\r\nI0917 09:59:07.306714       1 controller.go:182] ingress-shim controller: Finished processing work item \"default/cm-acme-http-solver-khgj4\"\r\nI0917 09:59:44.948581       1 controller.go:171] certificates controller: syncing item 'default/cafe-secret'\r\nI0917 09:59:44.948769       1 sync.go:274] Preparing certificate default/cafe-secret with issuer\r\nI0917 09:59:44.948964       1 logger.go:43] Calling GetOrder\r\nI0917 09:59:45.168699       1 prepare.go:263] Cleaning up previous order for certificate default/cafe-secret\r\nI0917 09:59:45.168776       1 prepare.go:279] Cleaning up old/expired challenges for Certificate default/cafe-secret\r\nI0917 09:59:45.168790       1 prepare.go:303] Cleaning up challenge for domain \"cafe.example.com\" as part of Certificate default/cafe-secret\r\nI0917 09:59:45.279308       1 ingress.go:49] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=2662927066,certmanager.k8s.io/acme-http-token=1173753626\r\nI0917 09:59:45.292421       1 logger.go:38] Calling CreateOrder\r\nI0917 09:59:45.297443       1 controller.go:168] ingress-shim controller: syncing item 'default/cm-acme-http-solver-khgj4'\r\nE0917 09:59:45.297565       1 controller.go:198] ingress 'default/cm-acme-http-solver-khgj4' in work queue no longer exists\r\nI0917 09:59:45.297599       1 controller.go:182] ingress-shim controller: Finished processing work item \"default/cm-acme-http-solver-khgj4\"\r\nI0917 09:59:46.112522       1 acme.go:126] Created order for domains: [{dns cafe.example.com}]\r\nI0917 09:59:46.112707       1 logger.go:73] Calling GetAuthorization\r\nI0917 09:59:46.279173       1 logger.go:93] Calling HTTP01ChallengeResponse\r\nI0917 09:59:46.279244       1 prepare.go:279] Cleaning up old/expired challenges for Certificate default/cafe-secret\r\nI0917 09:59:46.279258       1 logger.go:68] Calling GetChallenge\r\nI0917 09:59:46.479577       1 http.go:134] wrong status code '404'\r\nI0917 09:59:46.479785       1 pod.go:65] No existing HTTP01 challenge solver pod found for Certificate \"default/cafe-secret\". One will be created.\r\nI0917 09:59:46.491208       1 service.go:51] No existing HTTP01 challenge solver service found for Certificate \"default/cafe-secret\". One will be created.\r\nI0917 09:59:46.556794       1 ingress.go:49] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=2662927066,certmanager.k8s.io/acme-http-token=1255345787\r\nI0917 09:59:46.556878       1 ingress.go:102] No existing HTTP01 challenge solver ingress found for Certificate \"default/cafe-secret\". One will be created.\r\nI0917 09:59:46.586262       1 helpers.go:201] Found status change for Certificate \"cafe-secret\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-17 09:59:46.586243512 +0000 UTC m=+1680.490970014\r\nI0917 09:59:46.586336       1 sync.go:276] Error preparing issuer for certificate default/cafe-secret: http-01 self check failed for domain \"cafe.example.com\"\r\nE0917 09:59:46.586380       1 sync.go:197] [default/cafe-secret] Error getting certificate 'cafe-secret': secret \"cafe-secret\" not found\r\nI0917 09:59:46.590557       1 controller.go:168] ingress-shim controller: syncing item 'default/cm-acme-http-solver-xf27r'\r\nI0917 09:59:46.590615       1 sync.go:65] Not syncing ingress default/cm-acme-http-solver-xf27r as it does not contain necessary annotations\r\nI0917 09:59:46.590648       1 controller.go:182] ingress-shim controller: Finished processing work item \"default/cm-acme-http-solver-xf27r\"\r\nE0917 09:59:46.594168       1 controller.go:180] certificates controller: Re-queuing item \"default/cafe-secret\" due to error processing: http-01 self check failed for domain \"cafe.example.com\"\r\nI0917 09:59:46.594357       1 controller.go:168] ingress-shim controller: syncing item 'default/cafe-ingress'\r\nI0917 09:59:46.594469       1 sync.go:140] Certificate \"cafe-secret\" for ingress \"cafe-ingress\" already exists\r\nI0917 09:59:46.594531       1 sync.go:143] Certificate \"cafe-secret\" for ingress \"cafe-ingress\" is up to date\r\nI0917 09:59:46.594593       1 controller.go:182] ingress-shim controller: Finished processing work item \"default/cafe-ingress\"\r\nI0917 10:00:07.303689       1 controller.go:168] ingress-shim controller: syncing item 'default/cm-acme-http-solver-xf27r'\r\nI0917 10:00:07.303749       1 sync.go:65] Not syncing ingress default/cm-acme-http-solver-xf27r as it does not contain necessary annotations\r\nI0917 10:00:07.303771       1 controller.go:182] ingress-shim controller: Finished processing work item \"default/cm-acme-http-solver-xf27r\"\r\nI0917 10:00:46.594445       1 controller.go:171] certificates controller: syncing item 'default/cafe-secret'\r\nI0917 10:00:46.594570       1 sync.go:274] Preparing certificate default/cafe-secret with issuer\r\n\r\n``` \r\n\r\nI tried to curl the ingress path from the acme challenge manually and it looks good for me:\r\n```\r\ncurl cafe.example.com/.well-known/acme-challenge/t2c_vohgYKgeLGkvd8G2Qae4JtjQbB-uKN2P9X-zi0o\r\n\r\nt2c_vohgYKgeLGkvd8G2Qae4JtjQbB-uKN2P9X-zi0o.INzU8Z71WEdzjhNLo97HkqShzZoj32SMR177MoI1dNY\r\n``` \r\n\r\nI'm running a clusterissuer with the following configuration:\r\n\r\n```\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: ClusterIssuer\r\nmetadata:\r\n  clusterName: \"\"\r\n  name: letsencrypt-production\r\n  namespace: \"\"\r\nspec:\r\n  acme:\r\n    email: mail@example.com\r\n    http01: {}\r\n    privateKeySecretRef:\r\n      key: \"\"\r\n      name: letsencrypt-production\r\n    server: https://acme-v02.api.letsencrypt.org/directory\r\nstatus:\r\n  acme:\r\n    uri: https://acme-v02.api.letsencrypt.org/acme/acct/41673558\r\n  conditions:\r\n  - lastTransitionTime: 2018-09-17T09:58:39Z\r\n    message: The ACME account was registered with the ACME server\r\n    reason: ACMEAccountRegistered\r\n    status: \"True\"\r\n    type: Ready\r\n``` \r\n\r\nDoes anybody have an idea whats wrong here?\r\n\r\n**Environment details:**:\r\n- Kubernetes version (e.g. v1.10.2): 1.10.2\r\n- cert-manager version (e.g. v0.4.0): 0.5.0\r\n\r\n/kind bug\r\n"},"comment":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/comments/427789826","html_url":"https://github.com/jetstack/cert-manager/issues/913#issuecomment-427789826","issue_url":"https://api.github.com/repos/jetstack/cert-manager/issues/913","id":427789826,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzc4OTgyNg==","user":{"login":"EamonKeane","id":1946655,"node_id":"MDQ6VXNlcjE5NDY2NTU=","avatar_url":"https://avatars3.githubusercontent.com/u/1946655?v=4","gravatar_id":"","url":"https://api.github.com/users/EamonKeane","html_url":"https://github.com/EamonKeane","followers_url":"https://api.github.com/users/EamonKeane/followers","following_url":"https://api.github.com/users/EamonKeane/following{/other_user}","gists_url":"https://api.github.com/users/EamonKeane/gists{/gist_id}","starred_url":"https://api.github.com/users/EamonKeane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EamonKeane/subscriptions","organizations_url":"https://api.github.com/users/EamonKeane/orgs","repos_url":"https://api.github.com/users/EamonKeane/repos","events_url":"https://api.github.com/users/EamonKeane/events{/privacy}","received_events_url":"https://api.github.com/users/EamonKeane/received_events","type":"User","site_admin":false},"created_at":"2018-10-08T10:45:01Z","updated_at":"2018-10-08T10:45:01Z","author_association":"NONE","body":"Running into this as well (k8s `1.12.0`, cert-manager `0.5.0`). Did you resolve it @discostur ? This same setup worked for a few days ago nothing really has changed afaik."}}
{"actor":{"display_login":"EamonKeane"}}