<p>I'm trying to add a self-signed certificate in my AKS cluster using Cert-Manager.</p>
<p>I created a <code>ClusterIssuer</code> for the CA certificate (to sign the certificate) and a second <code>ClusterIssuer</code> for the Certificate (self-signed) I want to use.</p>
<p>I am not sure if the <code>certificate2</code> is being used correctly by Ingress as it looks like it is waiting for some event.</p>
<p>Am I following the correct way to do this?</p>
<p>This is the first <code>ClusterIssuer</code> &quot;clusterissuer.yml&quot;:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: selfsigned
spec:
  selfSigned: {} 
</code></pre>
<p>This is the CA certificate &quot;certificate.yml&quot;:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: selfsigned-certificate
spec:
  secretName: hello-deployment-tls-ca-key-pair
  dnsNames:
  - &quot;*.default.svc.cluster.local&quot;
  - &quot;*.default.com&quot;
  isCA: true
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer
</code></pre>
<p>This is the second <code>ClusterIssuer</code> &quot;clusterissuer2.yml&quot; for the certificate I want to use:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: hello-deployment-tls
spec:
 ca:
   secretName: hello-deployment-tls-ca-key-pair
</code></pre>
<p>and finally this is the self-signed certificate &quot;certificate2.yml&quot;:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: selfsigned-certificate2
spec:
  secretName: hello-deployment-tls-ca-key-pair2
  dnsNames:
  - &quot;*.default.svc.cluster.local&quot;
  - &quot;*.default.com&quot;
  isCA: false
  issuerRef:
    name: hello-deployment-tls
    kind: ClusterIssuer
</code></pre>
<p>I am using this certificate in an Ingress:</p>
<pre><code>--- 
apiVersion: extensions/v1beta1
kind: Ingress
metadata: 
  annotations: 
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: &quot;hello-deployment-tls&quot;
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
  name: sonar-ingress
spec: 
  tls: 
  - secretName: &quot;hello-deployment-tls-ca-key-pair2&quot;
  rules: 
  - http: 
      paths: 
      - pathType: Prefix
        path: &quot;/&quot;
        backend: 
          serviceName: sonarqube
          servicePort: 80

</code></pre>
<p>As I do not have any registered domain name I just want to use the public IP to access the service over <code>https://&lt;Public_IP&gt;</code>.</p>
<p>When I access to the service <code>https://&lt;Public_IP&gt;</code> I can see that &quot;Kubernetes Ingress Controller Fake Certificate&quot; so i guess this is because the certificate is not globally recognize by the browser.</p>
<p>The strange thing is here. Theoretically the Ingress deployment is using the <code>selfsigned-certificate2</code> but looks like it is not ready:</p>
<pre><code>kubectl get certificate
NAME                      READY   SECRET                              AGE
selfsigned-certificate    True    hello-deployment-tls-ca-key-pair    4h29m
selfsigned-certificate2   False   hello-deployment-tls-ca-key-pair2   3h3m
selfsigned-secret         True    selfsigned-secret                   5h25m
</code></pre>
<pre><code>kubectl describe certificate selfsigned-certificate2
. 
.
.
Spec:
  Dns Names:
    *.default.svc.cluster.local
    *.default.com
  Issuer Ref:
    Kind:       ClusterIssuer
    Name:       hello-deployment-tls
  Secret Name:  hello-deployment-tls-ca-key-pair2
Status:
  Conditions:
    Last Transition Time:  2021-10-15T11:16:15Z
    Message:               Waiting for CertificateRequest &quot;selfsigned-certificate2-3983093525&quot; to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:                    &lt;none&gt;
</code></pre>
<p>Any idea?</p>
<p>Thank you in advance.</p>

<h2>ApiVersions</h2>
<p>First I noticed you're using <code>v1alpha2</code> apiVersion which is depricated and will be removed in <code>1.6</code> cert-manager:</p>
<pre><code>$ kubectl apply -f cluster-alpha.yaml
Warning: cert-manager.io/v1alpha2 ClusterIssuer is deprecated in v1.4+, unavailable in v1.6+; use cert-manager.io/v1 ClusterIssuer
</code></pre>
<p>I used <code>apiVersion: cert-manager.io/v1</code> in reproduction.</p>
<p>Same for <code>v1beta1</code> ingress, consider updating it to <code>networking.k8s.io/v1</code>.</p>
<h2>What happens</h2>
<p>I started reproducing your setup step by step.</p>
<p>I applied <code>clusterissuer.yaml</code>:</p>
<pre><code>$ kubectl apply -f clusterissuer.yaml
clusterissuer.cert-manager.io/selfsigned created

$ kubectl get clusterissuer
NAME         READY   AGE
selfsigned   True    11s
</code></pre>
<p>Pay attention that <code>READY</code> is set to <code>True</code>.</p>
<p><strong>Next</strong> I applied <code>certificate.yaml</code>:</p>
<pre><code>$ kubectl apply -f cert.yaml
certificate.cert-manager.io/selfsigned-certificate created

$ kubectl get cert
NAME                     READY   SECRET                             AGE
selfsigned-certificate   True    hello-deployment-tls-ca-key-pair   7s
</code></pre>
<p><strong>Next step</strong> is to add the second <code>ClusterIssuer</code> which is referenced to <code>hello-deployment-tls-ca-key-pair</code> secret:</p>
<pre><code>$ kubectl apply -f clusterissuer2.yaml
clusterissuer.cert-manager.io/hello-deployment-tls created

$ kubectl get clusterissuer
NAME                   READY   AGE
hello-deployment-tls   False   6s
selfsigned             True    3m50
</code></pre>
<p>ClusterIssuer <code>hello-deployment-tls</code> is <strong>not</strong> ready. Here's why:</p>
<pre><code>$ kubectl describe clusterissuer hello-deployment-tls
...
Events:
  Type     Reason         Age                From          Message
  ----     ------         ----               ----          -------
  Warning  ErrGetKeyPair  10s (x5 over 75s)  cert-manager  Error getting keypair for CA issuer: secret &quot;hello-deployment-tls-ca-key-pair&quot; not found
  Warning  ErrInitIssuer  10s (x5 over 75s)  cert-manager  Error initializing issuer: secret &quot;hello-deployment-tls-ca-key-pair&quot; not found
</code></pre>
<p>This is expected behaviour since:</p>
<blockquote>
<p>When referencing a Secret resource in ClusterIssuer resources (eg
apiKeySecretRef) the Secret needs to be in the same namespace as the
cert-manager controller pod. You can optionally override this by using
the --cluster-resource-namespace argument to the controller.</p>
</blockquote>
<p><a href="https://docs.cert-manager.io/en/release-0.11/reference/clusterissuers.html" rel="noreferrer">Reference</a></p>
<h2>Answer - how to move forward</h2>
<p>I edited the <code>cert-manager</code> deployment so it will look for <code>secrets</code> in <code>default</code> namespace (this is not ideal, I'd use <code>issuer</code> instead in <code>default</code> namespace):</p>
<pre><code>$ kubectl edit deploy cert-manager -n cert-manager

spec:
  containers:
  - args:
    - --v=2
    - --cluster-resource-namespace=default
</code></pre>
<p>It takes about a minute for <code>cert-manager</code> to start. Redeployed <code>clusterissuer2.yaml</code>:</p>
<pre><code>$ kubectl delete -f clusterissuer2.yaml
clusterissuer.cert-manager.io &quot;hello-deployment-tls&quot; deleted

$ kubectl apply -f clusterissuer2.yaml
clusterissuer.cert-manager.io/hello-deployment-tls created

$ kubectl get clusterissuer
NAME                   READY   AGE
hello-deployment-tls   True    3s
selfsigned             True    5m42s
</code></pre>
<p>Both are <code>READY</code>. Moving forward with <code>certificate2.yaml</code>:</p>
<pre><code>$ kubectl apply -f cert2.yaml
certificate.cert-manager.io/selfsigned-certificate2 created

$ kubectl get cert
NAME                      READY   SECRET                              AGE
selfsigned-certificate    True    hello-deployment-tls-ca-key-pair    33s
selfsigned-certificate2   True    hello-deployment-tls-ca-key-pair2   6s

$ kubectl get certificaterequest
NAME                            APPROVED   DENIED   READY   ISSUER                 REQUESTOR                                         AGE
selfsigned-certificate-jj98f    True                True    selfsigned             system:serviceaccount:cert-manager:cert-manager   52s
selfsigned-certificate2-jwq5c   True                True    hello-deployment-tls   system:serviceaccount:cert-manager:cert-manager   25s
</code></pre>
<h2>Ingress</h2>
<p>When <code>host</code> is not added to <code>ingress</code>, it doesn't create any certificates and seems to used some fake one from <code>ingress</code> which is issued by <code>CN = Kubernetes Ingress Controller Fake Certificate</code>.</p>
<p>Events from <code>ingress</code>:</p>
<pre><code>Events:
  Type     Reason     Age   From                      Message
  ----     ------     ----  ----                      -------
  Warning  BadConfig  5s    cert-manager              TLS entry 0 is invalid: secret &quot;example-cert&quot; for ingress TLS has no hosts specified
</code></pre>
<p>When I added DNS to <code>ingress</code>:</p>
<pre><code>Events:
  Type     Reason             Age                From                      Message
  ----     ------             ----               ----                      -------
Normal   CreateCertificate  4s                 cert-manager              Successfully created Certificate &quot;example-cert&quot;
</code></pre>
<h2>Answer, part 2 (about ingress, certificates and issuer)</h2>
<p>You don't need to create a certificate if you're referencing to <code>issuer</code> in <code>ingress</code> rule. Ingress will issue certificate for you when all details are presented, such as:</p>
<ul>
<li>annotation <code>cert-manager.io/cluster-issuer: &quot;hello-deployment-tls&quot;</code></li>
<li><code>spec.tls</code> part with host within</li>
<li><code>spec.rules.host</code></li>
</ul>
<p><strong>OR</strong></p>
<p>if you want to create certificate manually and ask ingress to use it, then:</p>
<ul>
<li>remove annotation <code>cert-manager.io/cluster-issuer: &quot;hello-deployment-tls&quot;</code></li>
<li>create certificate manually</li>
<li>refer to it in <code>ingress rule</code>.</li>
</ul>
<p>You can check certificate details in browser and find that it no longer has issuer as <code>CN = Kubernetes Ingress Controller Fake Certificate</code>, in my case it's empty.</p>
<h2>Note - cert-manager v1.4</h2>
<p>Initially I used a bit outdated <code>cert-manager v1.4</code> and got <a href="https://github.com/jetstack/cert-manager/issues/4142" rel="noreferrer">this issue</a> which has gone after updating to <code>1.4.1</code>.</p>
<p>It looks like:</p>
<pre><code>$ kubectl describe certificaterequest selfsigned-certificate2-45k2c

Events:
  Type     Reason           Age   From          Message
  ----     ------           ----  ----          -------
  Normal   cert-manager.io  41s   cert-manager  Certificate request has been approved by cert-manager.io
  Warning  DecodeError      41s   cert-manager  Failed to decode returned certificate: error decoding certificate PEM block
</code></pre>
<h2>Useful links:</h2>
<ul>
<li><a href="https://docs.cert-manager.io/en/release-0.11/tasks/issuers/setup-selfsigned.html" rel="noreferrer">Setting up self-singed Issuer</a></li>
<li><a href="https://docs.cert-manager.io/en/release-0.11/tasks/issuers/setup-ca.html" rel="noreferrer">Setting up CA issuers</a></li>
<li><a href="https://docs.cert-manager.io/en/release-0.11/reference/clusterissuers.html" rel="noreferrer">Cluster Issuers</a></li>
</ul>
