<p>I run a kubernetes cluster with cert-manager installed for managing ACME (Let's Encrypt) certificates. I'm using DNS domain validation with Route 53 and it works all fine.</p>
<p>The problem comes when I try to issue a certificate for a cluster internal domain. In this case domain validation does not pass since the validation challenge is presented on external Route53 zone only, while cert-manager is trying to look for domain name via cluster internal DNS.</p>
<p>Any hints on how this can be solved are welcome.</p>

<p>Assuming that you don't control public DNS for your cluster internal domain, you will not be able to receive LetsEncrypt certificates for it.</p>
<p>You may however set up another issuer that will grant you certificates for this domain, e.g. the SelfSigned issuer: <a href="https://cert-manager.io/docs/configuration/selfsigned/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/selfsigned/</a>
Then set the <code>issuerRef</code> of your certificate object to point to your SelfSigned issuer:</p>
<pre class="lang-yaml prettyprint-override"><code>(...)
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
    group: cert-manager.io
</code></pre>
