<p>We've set-up a new ingress route that requires TLS certificate authentication, and we have placed it on its own subdomain, but we are finding that cert-manager is unable to issue a certificate for it.</p>
<p>Using the examples provided here, we generated the CA cert and CA key, and then configured the client certificate:
<a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/client-certs" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/client-certs</a></p>
<p>In the logs, I can see that all of the <code>.acme-challenge</code> requests are returning a 403. I am guessing that nginx is rejecting the requests because Let's Encrypt can't present a client certificate for the challenge request. What do I need to do in order to bypass the client cert requirement for ACME?</p>

<p>The issue here was that we actually had misconfigured the <code>nginx.ingress.kubernetes.io/auth-tls-secret</code> annotation. It <em>must</em> be in <code>namespace/name</code> format -- where <code>namespace</code> is the namespace that contains the secret containing the client CA certificate, and <code>name</code> is the name of that secret -- but we were only providing the name since the secret is in the same namespace with the ingress.</p>
<p>I was able to diagnose the issue by dumping the nginx ingress controller config to <code>nginx.conf.txt</code> with:</p>
<pre><code>  kubectl exec &lt;NAME OF INGRESS CONTROLLER POD&gt; -n &lt;INGRESS NAMESPACE&gt; -- nginx -T | tee nginx.conf.txt
</code></pre>
<p>(Adapted from <a href="https://docs.nginx.com/nginx-ingress-controller/troubleshooting/#checking-the-generated-config" rel="nofollow noreferrer">https://docs.nginx.com/nginx-ingress-controller/troubleshooting/#checking-the-generated-config</a>).</p>
<p>This included the following snippet:</p>
<pre><code>    ## start server the.hostname.com
    server {
        server_name the.hostname.com ;
        
        listen 80;
        
        set $proxy_upstream_name &quot;-&quot;;
        set $pass_access_scheme $scheme;
        set $pass_server_port $server_port;
        set $best_http_host $http_host;
        set $pass_port $pass_server_port;
        
        listen 443  ssl http2;
        
        # PEM sha: 66c07c44ba9637a23cd3d7b6ebce958e08a52ccb
        ssl_certificate                         /etc/ingress-controller/ssl/default-fake-certificate.pem;
        ssl_certificate_key                     /etc/ingress-controller/ssl/default-fake-certificate.pem;
        
        ssl_certificate_by_lua_block {
            certificate.call()
        }
        
        # Location denied, reason: invalid format (namespace/name) found in 'the-secret-name'
        return 403;
        
    }
    ## end server the.hostname.com
</code></pre>
<p>The key is these two lines:</p>
<pre><code>        # Location denied, reason: invalid format (namespace/name) found in 'the-secret-name'
        return 403;
</code></pre>
<p>This pointed me to the annotation for the secret name. Once I fixed that, ACME worked properly.</p>
