<p>I followed this DigitalOcean guide <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</a>, and I came across something quite strange. When in the hostnames I set a wildcard, then <code>letsencrypt</code> fails in issuing a new certificate. While when I only set defined sub-domains, then it works perfectly.</p>
<p>This is my &quot;working&quot; configuration for the domain and its api (and this one works perfectly):</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    cert-manager.io/cluster-issuer: &quot;letsencrypt-staging&quot;
spec:
  tls:
  - hosts:
    - example.com
    - api.example.com
    secretName: my-tls
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: example-frontend
          servicePort: 80
  - host: api.example.com
    http:
      paths:
      - backend:
          serviceName: example-api
          servicePort: 80
</code></pre>
<p>And this is, instead, the wildcard certificate I'm trying to issue, but that fails to do leaving the message &quot;Issuing&quot;.</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    cert-manager.io/cluster-issuer: &quot;letsencrypt-staging&quot;
spec:
  tls:
  - hosts:
    - example.com
    - *.example.com
    secretName: my-tls
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: example-frontend
          servicePort: 80
  - host: api.example.com
    http:
      paths:
      - backend:
          serviceName: example-api
          servicePort: 80
      
</code></pre>
<p>The only difference is the second line of the hosts. Is there a trivial well known solution I am not aware of? I am new to Kubernetes, but not to DevOps.</p>

<p>Generating wildcard certificate with <code>cert-manager</code> (<code>letsencrypt</code>) requires the usage of <code>DNS-01</code> challenge instead of <code>HTTP-01</code> <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">used in the link from the question</a>:</p>
<blockquote>
<h3>Does Let’s Encrypt issue wildcard certificates?</h3>
<p>Yes. Wildcard issuance must be done via ACMEv2 using the DNS-01 challenge. See <a href="https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578" rel="nofollow noreferrer">this post</a> for more technical information.</p>
</blockquote>
<p>There is a documentation about generating the <code>wildcard</code> certificate with <code>cert-manager</code>:</p>
<ul>
<li><em><a href="https://cert-manager.io/docs/configuration/acme/dns01/" rel="nofollow noreferrer">Cert-manager.io: Docs: Configuration: ACME: DNS-01</a></em></li>
</ul>
<hr />
<p>From the perspective of DigialOcean, there is a guide specifically targeted at it:</p>
<blockquote>
<p>This provider uses a Kubernetes <code>Secret</code> resource to work. In the following
example, the <code>Secret</code> will have to be named <code>digitalocean-dns</code> and have a
sub-key <code>access-token</code> with the token in it. For example:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: digitalocean-dns
  namespace: cert-manager
data:
  # insert your DO access token here
  access-token: &quot;base64 encoded access-token here&quot;
</code></pre>
<p>The access token must have write access.</p>
<p>To create a Personal Access Token, see <a href="https://www.digitalocean.com/docs/api/create-personal-access-token" rel="nofollow noreferrer">DigitalOcean documentation</a>.</p>
<p>Handy direct link: <a href="https://cloud.digitalocean.com/account/api/tokens/new" rel="nofollow noreferrer">https://cloud.digitalocean.com/account/api/tokens/new</a></p>
<p>To encode your access token into base64, you can use the following</p>
<pre class="lang-sh prettyprint-override"><code>echo -n 'your-access-token' | base64 -w 0
</code></pre>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: example-issuer
spec:
  acme:
    ...
    solvers:
    - dns01:
        digitalocean:
          tokenSecretRef:
            name: digitalocean-dns
            key: access-token
</code></pre>
<p>-- <em><a href="https://cert-manager.io/docs/configuration/acme/dns01/digitalocean/" rel="nofollow noreferrer">Cert-manager.io: Docs: Configuration: ACME: DNS-01: Digitalocean</a></em></p>
</blockquote>
<hr />
<p>I'd reckon this additional resources could also help:</p>
<ul>
<li><em><a href="https://stackoverflow.com/questions/51613842/wildcard-ssl-certificate-with-subdomain-redirect-in-kubernetes">Stackoverflow.com: Questions: Wilcard SSL certificate with subdomain redirect in Kubernetes</a></em></li>
<li><em><a href="https://itnext.io/using-wildcard-certificates-with-cert-manager-in-kubernetes-and-replicating-across-all-namespaces-5ed1ea30bb93" rel="nofollow noreferrer">Itnext.io: Using wildcard certificates with cert-manager in Kubernetes</a></em></li>
</ul>
