<p>We are using <code>jetstack/cert-manager</code> to automate certificate management in a k8s environment.</p>
<p>Applying a Certificate with <code>kubectl apply -f cert.yaml</code> works just fine:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: test-cert
spec:
  secretName: test-secret
  issuerRef:
    name: letsencrypt
    kind: Issuer

  dnsNames:
    - development.my-domain.com
    - production.my-domain.com
</code></pre>
<p>However, it fails when installing a Helm template:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{.Values.cert}}
spec:
  secretName: {{.Values.secret}}
  issuerRef:
    name: letsencrypt
    kind: Issuer
  dnsNames: [{{.Values.dnsNames}}]
</code></pre>
<pre><code>E0129 09:57:51.911270       1 sync.go:264] cert-manager/controller/orders &quot;msg&quot;=&quot;failed to create Order resource due to bad request, marking Order as failed&quot; &quot;error&quot;=&quot;400 urn:ietf:params:acme:error:rejectedIdentifier: NewOrder request did not include a SAN short enough to fit in CN&quot; &quot;resource_kind&quot;=&quot;Order&quot; &quot;resource_name&quot;=&quot;test-cert-45hgz-605454840&quot; &quot;resource_namespace&quot;=&quot;default&quot; &quot;resource_version&quot;=&quot;v1&quot;
</code></pre>

<p>Try to inspect you Certificate object wiht <code>kubectl -n default describe certificate test-cert</code> and post here if you don't find any issues with it.</p>
<p>your Certificate Object should be like the following:</p>
<pre class="lang-yaml prettyprint-override"><code>Name:         test-cert
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
API Version:  cert-manager.io/v1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2022-01-28T12:25:40Z
  Generation:          4
  Managed Fields:
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:dnsNames:
        f:issuerRef:
          .:
          f:kind:
          f:name:
        f:secretName:
    Manager:      kubectl-client-side-apply
    Operation:    Update
    Time:         2022-01-28T12:25:40Z
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:status:
        .:
        f:conditions:
        f:lastFailureTime:
        f:notAfter:
        f:notBefore:
        f:renewalTime:
        f:revision:
    Manager:         controller
    Operation:       Update
    Subresource:     status
    Time:            2022-01-29T09:57:51Z
  Resource Version:  344677
  Self Link:         /apis/cert-manager.io/v1/namespaces/istio-ingress/certificates/test-cert-2
  UID:               0015cc16-06c3-4e33-bb99-0f336cf7b788
Spec:
  Dns Names:
    development.my-domain.com
    production.my-domain.com
  Issuer Ref:
    Kind:       Issuer
    Name:       letsencrypt
  Secret Name:  test-secret
</code></pre>
<p>Pay closer attention to Spec.DnsNames values. Sometime Heml's template engine renders it as string instead of array object due to missconfigurating.</p>
<p>Also, it's a good proctice to inspect Helm charts with
<code>helm template mychart</code> before installing.</p>
