<p>I am experiencing a rather weird issue and have been stuck on this for 2 days. I have a kubernetes cluster running nginx-ingress and cert-manager. Everything seems to be working fine though when visiting my website through HTTPS, it gives the following error (in chromium edge):</p>
<p><code>NET::ERR_CERT_AUTHORITY_INVALID</code></p>
<p>If I continue anyways, it loads the site normally but without the certificate.</p>
<p>The certificate is properly being given, secret created, no errors anywhere.</p>
<p>I have the following annotations in my ingress resource:</p>
<pre><code>    kubernetes.io/ingress.class: &quot;nginx&quot;
    kubernetes.io/tls-acme: &quot;true&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-production&quot;
    ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
</code></pre>
<p>My cluster issuer:</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    # The ACME production api URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: *********
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-production
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx
</code></pre>
<p>The certificate resource returns:</p>
<pre><code> Normal  Issuing    108s   cert-manager  The certificate has been successfully issued
</code></pre>
<p>I am relatively new to kubernetes so let me know if there are any other debugging steps I can take.</p>

<p>You are using acme staging <code>server: https://acme-staging-v02.api.letsencrypt.org/directory</code> server which does not provide valid certificate.
To get valid certificate you have to use acme production server <code> server: https://acme-v02.api.letsencrypt.org/directory</code>.
you can try this.</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    # The ACME production api URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: *********
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-production
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx

</code></pre>
