<p>I have created Clusterissuer that uses Vault and then issued certificate through it but the <em>Ready</em> status of the certificate is blank. There is nothing appearing in the events and cert-manager pod logs. It has not created a secret as well. </p>

<pre><code>kubectl get cert
NAMESPACE             NAME                 READY                          SECRET                                             AGE
default               example-com                                         example-com                                      139m
</code></pre>

<p>clusterissuer.yaml</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: vault-clusterissuer
spec:
  vault:
    path: pki_int/sign/&lt;role name&gt;
    server: https://vault-cluster.example.com:8200
    caBundle: &lt;base64 encoded cabundle pem&gt;
    auth:
      appRole:
        path: approle
        roleId: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" 
        secretRef:
          name: cert-manager-vault-approle
          key: secretId
</code></pre>

<p>The role name mentioned in the Path is the same as the role created in the Vault under pki_init.</p>

<p>certificate.yaml</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: example-com
spec:
  secretName: example-com 
  issuerRef:
    name: vault-clusterissuer
    kind: ClusterIssuer
  commonName: abc.example.com
  dnsNames:
  - abc.example.com
</code></pre>

<p>Since it is not generating any message or logs so I am not sure from where to start troubleshooting.</p>

<p>Does the value of <em>path</em> in clusterissuer.yaml looks right to you..?</p>

<p>Thank you in advance</p>

<p><strong>CertificateConditionReady</strong> indicates that a certificate is ready for use.</p>
<p>This is defined as:</p>
<ul>
<li><p>The target secret exists</p>
</li>
<li><p>The target secret contains a certificate that has not expired</p>
</li>
<li><p>The target secret contains a private key valid for the certificate</p>
</li>
<li><p>The <code>commonName</code> and <code>dnsNames</code> attributes match those specified on the Certificate</p>
</li>
</ul>
<p>I think the issue is in wrong <code>dnsNames</code> defined in <code>certificate.yaml</code> file:</p>
<p>Your certificate configuration file:</p>
<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: example-com
spec:
  secretName: example-com 
  issuerRef:
    name: vault-clusterissuer
    kind: ClusterIssuer
  commonName: abc.example.com
  dnsNames:
  - abc.example.com
</code></pre>
<p><code>dnsNames</code> field should have value: <code>www.abc.example.com</code> not <code>abc.example.com</code></p>
<p>Final version should looks like:</p>
<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: example-com
spec:
  secretName: example-com 
  issuerRef:
    name: vault-clusterissuer
    kind: ClusterIssuer
  commonName: abc.example.com
  dnsNames:
  - www.abc.example.com
</code></pre>
<p>Also remember that <code>path</code> field is the Vault role path of the PKI backend and <em>server</em> is the Vault server base URL. The <code>path</code> <strong>MUST</strong> USE the vault <code>sign</code> endpoint.</p>
<p>Please take a look: <a href="https://docs.cert-manager.io/en/release-0.8/tasks/issuers/setup-vault.html" rel="nofollow noreferrer">issuer-vault-setup</a>, <a href="https://github.com/jetstack/cert-manager/pull/1114/files" rel="nofollow noreferrer">cert-clusterissuer</a>.</p>
