<p>Cert-manager various versions ( 15 and 16 ) installed on both k3s version v1.18.8+k3s1 and docker-desktop version v1.16.6-beta.0 using the following command:</p>
<pre class="lang-sh prettyprint-override"><code>helm install cert-manager \
--namespace cert-manager jetstack/cert-manager \
--version v0.16.1 \
--set installCRDs=true \
--set 'extraArgs={--dns01-recursive-nameservers=1.1.1.1:53}'
</code></pre>
<p>I applied the following test yaml file:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Namespace
metadata:
  name: test
---
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: test
type: Opaque
stringData:
  api-token: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt
  namespace: test
spec:
  acme:
    email: user@example.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - dns01:
        cloudflare:
          email: user@example.com
          apiTokenSecretRef:
            name: cloudflare-api-token-secret
            key: api-token
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: example.com
  namespace: test
spec:
  secretName: example.com-tls
  issuerRef:
    name: letsencrypt
  dnsNames:
  - example.com
</code></pre>
<p>Result (I have waited even hours):</p>
<pre><code>kubectl -n test get certs,certificaterequests,order,challenges,ingress -o wide
NAME                                      READY   SECRET            ISSUER        STATUS                                         AGE
certificate.cert-manager.io/example.com   False   example.com-tls   letsencrypt   Issuing certificate as Secret does not exist   57s

NAME                                                   READY   ISSUER        STATUS                                                                                   AGE
certificaterequest.cert-manager.io/example.com-rx7jg   False   letsencrypt   Waiting on certificate issuance from order test/example.com-rx7jg-273779930: &quot;pending&quot;   56s

NAME                                                     STATE     ISSUER        REASON   AGE
order.acme.cert-manager.io/example.com-rx7jg-273779930   pending   letsencrypt            55s

NAME                                                                   STATE     DOMAIN        REASON                                                                                AGE
challenge.acme.cert-manager.io/example.com-rx7jg-273779930-625151916   pending   example.com   Cloudflare API error for POST &quot;/zones/xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx/dns_records&quot;   53s
</code></pre>
<p>Cloudflare setting are the ones from:
<a href="https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/</a> and i have tried with both token and key.</p>
<p>Cert-manager pod logs:</p>
<pre><code>I0828 08:34:51.370299       1 dns.go:102] cert-manager/controller/challenges/Present &quot;msg&quot;=&quot;presenting DNS01 challenge for domain&quot; &quot;dnsName&quot;=&quot;example.com&quot; &quot;domain&quot;=&quot;example.com&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;example.com-m72dq-3139291111-641020922&quot; &quot;resource_namespace&quot;=&quot;test&quot; &quot;type&quot;=&quot;dns-01&quot;
E0828 08:34:55.251730       1 controller.go:158] cert-manager/controller/challenges &quot;msg&quot;=&quot;re-queuing item  due to error processing&quot; &quot;error&quot;=&quot;Cloudflare API error for POST \&quot;/zones/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/dns_records\&quot;&quot; &quot;key&quot;=&quot;test/example.com-m72dq-3139291111-641020922&quot;
I0828 08:35:35.251982       1 controller.go:152] cert-manager/controller/challenges &quot;msg&quot;=&quot;syncing item&quot; &quot;key&quot;=&quot;test/example.com-m72dq-3139291111-641020922&quot;
I0828 08:35:35.252131       1 dns.go:102] cert-manager/controller/challenges/Present &quot;msg&quot;=&quot;presenting DNS01 challenge for domain&quot; &quot;dnsName&quot;=&quot;example.com&quot; &quot;domain&quot;=&quot;example.com&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;example.com-m72dq-3139291111-641020922&quot; &quot;resource_namespace&quot;=&quot;test&quot; &quot;type&quot;=&quot;dns-01&quot;
E0828 08:35:38.797954       1 controller.go:158] cert-manager/controller/challenges &quot;msg&quot;=&quot;re-queuing item  due to error processing&quot; &quot;error&quot;=&quot;Cloudflare API error for POST \&quot;/zones/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/dns_records\&quot;&quot; &quot;key&quot;=&quot;test/example.com-m72dq-3139291111-641020922&quot;
</code></pre>
<p>What's wrong?</p>
<p>Thank you!</p>

<p>Not 100% if it'll resolve your issue but I did come across this thread - <a href="https://github.com/jetstack/cert-manager/issues/1163" rel="nofollow noreferrer">https://github.com/jetstack/cert-manager/issues/1163</a>. They show <code>helm</code> being invoked like this and purporting it worked.</p>
<pre><code>$ helm install \                                       
  --name cert-manager \
  --namespace cert-manager \
  --version v0.7.0 \
  --set ingressShim.defaultIssuerKind=ClusterIssuer \              
  --set ingressShim.defaultIssuerName=letsencrypt-staging-issuer \
  --set extraArgs='{--dns01-recursive-nameservers-only,--dns01-self-check-nameservers=8.8.8.8:53\,1.1.1.1:53}' \
  jetstack/cert-manager
</code></pre>
