<p>I've configured Let's Encrypt using cert-manager in my cluster and it works just fine for most of my use cases. However I have an application which is installed multiple times on the same hostname but with a different path.</p>
<p>My ingress is defined as below</p>
<pre><code>{{- if .Values.ingress.enabled -}}
{{- $fullName := include &quot;whoami-go.fullname&quot; . -}}
{{- $svcPort := .Values.service.port -}}
{{- $tls := hasKey .Values.ingress &quot;certIssuer&quot; -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    {{- include &quot;whoami-go.labels&quot; . | nindent 4 }}
  annotations:
  {{- if $tls }}
    cert-manager.io/cluster-issuer: {{ .Values.ingress.certIssuer | quote }}
    ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
  {{- end }}
spec:
  {{- if $tls }}
  tls:
    - secretName: {{ $fullName }}-tls
      hosts:
        - {{ .Values.ingress.hostname | quote }}
  {{- end }}
  rules:
    - host: {{ .Values.ingress.hostname | quote }}
      http:
        paths:
          - path: {{ .Values.ingress.path }}
            pathType: Prefix
            backend:
              service:
                name: {{ $fullName }}
                port:
                  number: {{ $svcPort }}
{{- end }}
</code></pre>
<p>And it's instantiated with values like below</p>
<pre><code>ingress:
  enabled: true
  hostname: whoami-go.c.dhis2.org
  path: /something
  certIssuer: letsencrypt-prod
</code></pre>
<p>Where <code>path</code> is changed for each installation.</p>
<p>The problem...</p>
<pre><code>E0520 03:13:49.242770 1 sync.go:210] cert-manager/controller/orders &quot;msg&quot;=&quot;failed to create Order resource due to bad request, marking Order as failed&quot; &quot;error&quot;=&quot;429 urn:ietf:params:acme:error:rateLimited: Error creating new order :: too many certificates already issued for exact set of domains: whoami-go.c.dhis2.org: see https://letsencrypt.org/docs/rate-limits/&quot; &quot;resource_kind&quot;=&quot;Order&quot; &quot;resource_name&quot;=&quot;finland-whoami-go-tls-tzvk6-4169341110&quot; &quot;resource_namespace&quot;=&quot;whoami&quot; &quot;resource_version&quot;=&quot;v1&quot;
</code></pre>
<p>Since only the path is updated I hoped that cert-manager would reuse the certificate but that's obviously not the case. Can I somehow configure my application to use the same certificate for the same hostname across multiple installations of the same chart?</p>

<p>Error meaning</p>
<pre><code>urn:ietf:params:acme:error:rateLimited: Error creating new order :: too many certificates already issued for exact set of domains: whoami-go.c.dhis2.org:
</code></pre>
<p>we can only request a certain amount of SSL/TLS certificate from the let's encrypt in week.</p>
<p>Read more at : <a href="https://letsencrypt.org/docs/rate-limits/" rel="nofollow noreferrer">https://letsencrypt.org/docs/rate-limits/</a></p>
<p>Due to that, it's showing the error of the rate-limiting. We can request for the 5 cert per week for duplicate cert.</p>
<p>you are using the <strong>certIssuer: letsencrypt-prod</strong> or cluster issuer which will be storing the secret into the <strong>Kubernetes secret</strong>.</p>
<p>While creating the ingress with different paths just change secret or add the secret to ingress as per need your ingress will be working with HTTPS.</p>
<p>while keep only one ingress with cluster issuer or issuer so if certificate getting explored it can auto-renew in to secret and that secret will be used by other ingress.</p>
<p>my simple ingress with he <strong>SSL/TLS</strong> cert stored into secret.</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: sls-dev
    nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;1800&quot;
    nginx.ingress.kubernetes.io/proxy-send-timeout: &quot;1800&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/proxy-body-size: &quot;15m&quot;
  name: sls-function-ingress
spec:
  rules:
  - host: app.dev.example.io
    http:
      paths:
      - path: /api/v1/
        backend:
          serviceName: test-service
          servicePort: 80
  tls:
  - hosts:
    - app.dev.example.io
    secretName: sls-secret
</code></pre>
<p>you can keep <code>cert-manager.io/cluster-issuer: sls-dev</code> to one ingress while with other only <strong>secret</strong> need to attach.</p>
