<p>I followed this instruction to set up a cert-manager on my EKS cluster <a href="https://cert-manager.io/docs/tutorials/acme/ingress/" rel="nofollow noreferrer">https://cert-manager.io/docs/tutorials/acme/ingress/</a>.</p>
<p>here is my ingress</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    cert-manager.io/issuer: &quot;letsencrypt-staging&quot;
spec:
  tls:
  - hosts:
      - '*.test.com'
    secretName: test-tls
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: test-service
                port:
                  number: 80
</code></pre>
<p>Here is the issuer. I just copied the config from the instruction</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: info@test.com
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - http01:
          ingress:
            class: nginx
</code></pre>
<p>After deployment, I found the certificate ready state is false</p>
<pre><code>kubectl get certificate
NAME          READY   SECRET        AGE
test-tls   False   test-tls   2m45s
</code></pre>
<p>Then I followed this to troubleshoot <a href="https://cert-manager.io/docs/faq/troubleshooting/" rel="nofollow noreferrer">https://cert-manager.io/docs/faq/troubleshooting/</a></p>
<p>I ran <code>kubectl describe certificaterequest &lt;request name&gt;</code>, found error <code>Waiting on certificate issuance from order test-tls-xxx: &quot;pending&quot;</code></p>
<p>then ran <code>kubectl describe order  test-tls-xxx</code>, found error
<code> Warning  Solver  20m   cert-manager  Failed to determine a valid solver configuration for the set of domains on the Order: no configured challenge solvers can be used for this challenge</code>.</p>
<p>Any idea why it couldn't determine a valid solver? how do I test if solver is working?</p>

<p>It's not working due you are using the staging URL in <code>cluster issuer</code> to verify the image.</p>
<p>Please try with the Production URL.</p>
<p>here a simple and proper example of Clusterissuer and ingress YAML (do note you were trying with staging API <a href="https://acme-staging-v02.api.letsencrypt.org/directory" rel="nofollow noreferrer">https://acme-staging-v02.api.letsencrypt.org/directory</a> if possible use the production server address so it works properly with all browsers)</p>
<p>Example:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: cluster-issuer-name
  namespace: development
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: harsh@example.com
    privateKeySecretRef:
      name: secret-name
    solvers:
    - http01:
        ingress:
          class: nginx-class-name
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx-class-name
    cert-manager.io/cluster-issuer: cluster-issuer-name
    nginx.ingress.kubernetes.io/rewrite-target: /
  name: example-ingress
spec:
  rules:
  - host: sub.example.com
    http:
      paths:
      - path: /api
        backend:
          serviceName: service-name
          servicePort: 80
  tls:
  - hosts:
    - sub.example.com
    secretName: secret-name
</code></pre>
<p><strong>Note</strong> : When you are trying again please try deleting the old objects like ingress, Clusterissuer first.</p>
<p><strong>Issuer vs ClusterIssuer</strong></p>
<blockquote>
<p>An Issuer is a namespaced resource, and it is not possible to issue
certificates from an Issuer in a different namespace. This means you
will need to create an Issuer in each namespace you wish to obtain
Certificates in.</p>
<p>If you want to create a single Issuer that can be consumed in multiple
namespaces, you should consider creating a ClusterIssuer resource.
This is almost identical to the Issuer resource, however is
non-namespaced so it can be used to issue Certificates across all
namespaces.</p>
</blockquote>
<p>Ref : <a href="https://cert-manager.io/docs/concepts/issuer/" rel="nofollow noreferrer">https://cert-manager.io/docs/concepts/issuer/</a></p>
<p><strong>Wildcard cert</strong></p>
<p>You can use as per requirement, if you are using <strong>issuer</strong> you can update the <strong>ingress</strong> <strong>annotation</strong> line like</p>
<pre><code>cert-manager.io/issuer: issuer-name
</code></pre>
<p>If you are trying to get the <strong>wildcard</strong> <code>*</code> certificate you won't be able to get it using <strong>HTTP auth</strong> method</p>
<pre><code>solvers:
        - http01:
            ingress:
              class: nginx-class-name
</code></pre>
<p>instead of this you have to use the <strong>DNS-auth</strong> method for <strong>wildcard</strong> cert.</p>
<pre><code>solvers:
    - dns01:
        cloudDNS:
          project: my-project
          serviceAccountSecretRef:
            name: prod-clouddns-svc-acct-secret
            key: service-account.json
</code></pre>
<p>Read more at : <a href="https://cert-manager.io/docs/configuration/acme/dns01/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/acme/dns01/</a></p>
<p>Ref article to get the wildcard cert : <a href="https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2" rel="nofollow noreferrer">https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2</a></p>
