<p>I followed this tutorial <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</a> to issue a SSL certificate for my ingress using cert manager and Let's encrypt and I run this error  <code>Issuing certificate as Secret does not exist</code>. Is my configuration wrong? It's a Minikube local cluster.</p>
<p>staging_issuer.yaml</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt-staging
 namespace: cert-manager
spec:
 acme:
   # The ACME server URL
   server: https://acme-staging-v02.api.letsencrypt.org/directory
   # Email address used for ACME registration
   email: email_address
   # Name of a secret used to store the ACME account private key
   privateKeySecretRef:
     name: letsencrypt-staging
   # Enable the HTTP-01 challenge provider
   solvers:
   - http01:
       ingress:
         class:  nginx
</code></pre>
<p>ingress.yaml</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: echo-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;12h&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-staging&quot;
spec:
  tls:
  - hosts:
    - frontend.info
    - backend.info
    secretName: echo-tls
  rules:
  - host: frontend.info
    http:
      paths:
      - backend:
          serviceName: frontend
          servicePort: 80
  - host: backend.info
    http:
      paths:
      - backend:
          serviceName: backend
          servicePort: 8080
</code></pre>
<p>kubectl describe certificate</p>
<pre><code>Name:         echo-tls
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
API Version:  cert-manager.io/v1beta1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2021-01-26T09:29:54Z
  Generation:          1
  Managed Fields:
    API Version:  cert-manager.io/v1alpha2
    Fields Type:  FieldsV1
    Manager:    controller
    Operation:  Update
    Time:       2021-01-26T09:29:55Z
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  echo-ingress
    UID:                   &lt;UID&gt;
  Resource Version:        423812
  UID:                     &lt;UID&gt;
Spec:
  Dns Names:
    frontend.info
    backend.info
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt-staging
  Secret Name:  echo-tls
Status:
  Conditions:
    Last Transition Time:        2021-01-26T09:29:54Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
    Last Transition Time:        2021-01-26T09:29:54Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
  Next Private Key Secret Name:  echo-tls-hg5tt
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Issuing    7h56m  cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  7h56m  cert-manager  Stored new private key in temporary Secret resource &quot;echo-tls-hg5tt&quot;
  Normal  Requested  7h56m  cert-manager  Created new CertificateRequest resource &quot;echo-tls-hmz86
</code></pre>

<p>Let' start from answering your question about the event:</p>
<pre class="lang-yaml prettyprint-override"><code>Events:
  Type    Reason     Age    From          Message
  Normal  Issuing    7h56m  cert-manager  Issuing certificate as Secret does not exist
</code></pre>
<p>This is not an error and it is not a blocking factor. As you can see in the <code>type</code> section this is marked as <code>Normal</code>.  The events type that you should worry about are <code>Warning</code> events, like here:</p>
<pre class="lang-yaml prettyprint-override"><code>Events:
  Type     Reason     Age                From                                                    Message
  Warning  Unhealthy  2m (x2 over 2m)    kubelet, ip-XXX-XXX-XXX-XXX.us-west-2.compute.internal  Readiness probe failed: Get http://XXX.XXX.XXX.XXX:YYY/healthz: dial tcp connect: connection refused
</code></pre>
<hr />
<p>Now coming to your real problem. The documentation that you provided clearly states in prerequisites section that you need to have a domain name and a DNS A record pointing to the DigitalOcean Load Balancer used by the Ingress (in your case you would want to point it towards <code>minikube</code>). Assuming you are the owner of the two domains you mentioned in the yamls I noticed that they points to a two different ip address:</p>
<pre class="lang-yaml prettyprint-override"><code>$ dig frontend.info
;; ANSWER SECTION:
frontend.info.          599     IN      A       104.247.81.51
</code></pre>
<pre class="lang-yaml prettyprint-override"><code>$ dig backend.info
;; ANSWER SECTION:
backend.info.           21599   IN      A       127.0.0.1
</code></pre>
<p>Domain has to point to  <code>external-ip</code> address of a machine where <code>minikube</code> is running (in my case it was cloud virtual machine). Having this, it is sill not enough since <code>minikube</code> typically runs in its own docker container or vm. You need to make sure the traffic actually reaches your minikube cluster.</p>
<p>For that purpose I have used <code>kubectl port-fowarding</code> to expose the <code>nginx-controller</code> pod:</p>
<pre class="lang-sh prettyprint-override"><code>sudo kubectl port-forward pod/ingress-nginx-controller-69ccf5d9d8-mdkrr -n kube-system 80:80 --address 0.0.0.0

Forwarding from 0.0.0.0:80 -&gt; 80 
</code></pre>
<p>Let's encrypt needs to have access to your application to prove that you are the owner of the domain.  Once this is achieved your certificate object will change it status to <code>True</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>➜  ~ k get certificate                        
NAME       READY   SECRET     AGE
echo-tls   True    echo-tls   104m
</code></pre>
<p>Here you have final test. Please note that I was using my own domain which I just changed into <code>&lt;your-domain&gt;</code>. In your case this would <code>frontend.info</code> or <code>backend.info</code></p>
<pre class="lang-java prettyprint-override"><code>➜  ~ curl https://&lt;your-domain&gt; -v         
-----
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=test-domain.com
*  start date: Jan 27 10:09:31 2021 GMT
*  expire date: Apr 27 10:09:31 2021 GMT
*  subjectAltName: host &quot;&lt;your-domain&gt;&quot; matched cert's &quot;&lt;your-domain&gt;&quot;
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
-----
</code></pre>
