<p>I'm running into an issue handling tls certificates with cert-manager, I'm following the documentation and added some extras to work with <code>Traefik</code> as an ingress.</p>
<p>Currently, I have this <code>YAML</code> files:</p>
<p><strong>cluster-issuer.yaml</strong></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: secure-alexguedescom
spec:
  acme:
    email: user@gmail.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource used to store the account's private key.
      name: letsencrypt-staging
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
      - selector: {}
        http01:
          ingress:
            class: traefik-cert-manager
</code></pre>
<p><strong>traefik-ingress.yaml</strong></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    # add an annotation indicating the issuer to use.
    cert-manager.io/cluster-issuer: letsencrypt-staging
  name: secure-alexguedescom-ingress-http
  namespace: secure-alexguedescom
spec:
  rules:
  - host: secure.alexguedes.com
    http:
      paths:
      - backend:
          serviceName: secure-alexguedescom-nginx
          servicePort: 80
        path: /
  tls: 
  - hosts:
    - secure.alexguedes.com
    secretName: secure-alexguedescom-cert 
</code></pre>
<p><strong>cert-staging.yaml</strong></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: secure-alexguedescom-cert
  namespace: secure-alexguedescom
spec:
  commonName: secure.alexguedes.com
  secretName: letsencrypt-staging
  dnsNames:
    - secure.alexguedes.com
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
</code></pre>
<p>Inspecting the certs I have this error message:</p>
<pre class="lang-sh prettyprint-override"><code>Message: Issuing certificate as Secret does not contain a certificate
Reason: MissingData
</code></pre>
<p>Also inspecting the <code>certificaterequest</code> I have this log messages:</p>
<pre class="lang-yaml prettyprint-override"><code>Status:
  Conditions:
    Last Transition Time:  2020-08-16T00:32:01Z
    Message:               Waiting on certificate issuance from order secure-alexguedescom/secure-alexguedescom-cert-q8w5p-1982372682: &quot;pending&quot;
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  OrderCreated  11m   cert-manager  Created Order resource secure-alexguedescom/secure-alexguedescom-cert-q8w5p-1982372682
  Normal  OrderPending  11m   cert-manager  Waiting on certificate issuance from order secure-alexguedescom/secure-alexguedescom-cert-q8w5p-1982372682: &quot;&quot;
</code></pre>
<p>I'm not sure which piece is wrong, using Helm v2 with Tiller and k8s v1.7</p>
<p>Any ideas?</p>
<p>Thanks in advance</p>

<p>The typical problem with <a href="https://letsencrypt.org/" rel="noreferrer">letsencrypt</a> certs is the letsencrypt itself not being able to validate who you are and that you own the domain. In this case, <code>alexguedes.com</code>.</p>
<p>With cert-manager you can do <a href="https://cert-manager.io/docs/tutorials/acme/dns-validation/" rel="noreferrer">Domain Validation</a> and <a href="https://cert-manager.io/docs/tutorials/acme/http-validation/" rel="noreferrer">HTTP Validation</a>. Based on the posted <code>ClusterIssuer</code> you are doing HTTP Validation. So you need to make sure that <code>secure.alexguedes.com</code> resolves to a globally available IP address and that Traefik port <code>443</code> is listening on that IP address.</p>
