<p>I am creating a ClusterIssuer and a Certificate. However, there is <em><strong>no</strong></em> <code>tls.crt</code> on the secret! What I am doing wrong?</p>
<p>The clusterissuer looks like is running fine, but neither the keys has the crt</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-myapp-clusterissuer
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: app@example.com
    privateKeySecretRef:
      name: wildcard-myapp-com
    solvers:
      - dns01:
          cloudDNS:
            serviceAccountSecretRef:
              name: clouddns-service-account
              key: dns-service-account.json
            project: app
        selector:
          dnsNames:
            - '*.myapp.com'
            - myapp.com
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-com-tls
  namespace: cert-manager
spec:
  secretName: myapp-com-tls
  issuerRef:
    name: letsencrypt-myapp-issuer
    kind: ClusterIssuer
  commonName: '*.myapp.com'
  dnsNames:
    - 'myapp.com'
    - '*.myapp.com'
</code></pre>
<p><a href="https://i.stack.imgur.com/s65zp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/s65zp.png" alt="enter image description here" /></a>
<a href="https://i.stack.imgur.com/5ZlNZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/5ZlNZ.png" alt="enter image description here" /></a></p>

<p>With the information provided it is very hard to troubleshoot this, you could be hitting this <a href="https://github.com/cert-manager/cert-manager/issues/2111" rel="nofollow noreferrer">bug</a>.</p>
<p>You can start troubleshooting this kind of issues by following this procedure:</p>
<ol>
<li>Get the certificate request name:</li>
</ol>
<pre><code>kubectl -n &lt;namespace&gt; describe certificate myapp-com-tls
...
Created new CertificateRequest resource &quot;myapp-com-tls-xxxxxxx&quot;
</code></pre>
<ol start="2">
<li>The request will generate an order, get the order name with the command:</li>
</ol>
<pre><code>kubectl -n &lt;namespace&gt; describe certificaterequests myapp-com-tls-xxxxxxx
…
Created Order resource &lt;namespace&gt;/myapp-com-tls-xxxxxxx-xxxxx
</code></pre>
<ol start="3">
<li>The order will generate a challenge resource, get that with:</li>
</ol>
<pre><code>kubectl -n &lt;namespace&gt; describe order myapp-com-tls-xxxxxxx-xxxxx
…
Created Challenge resource &quot;myapp-com-tls-xxxxxxx-xxxxx-xxxxx&quot; for domain &quot;yourdomain.com&quot;
</code></pre>
<ol start="4">
<li>Finally, with the challenge name, you can get the status of the validation for you certificate:</li>
</ol>
<pre><code>kubectl -n &lt;namespace&gt; describe challenges myapp-com-tls-xxxxxxx-xxxxx-xxxxx
...
  Reason:      Successfully authorized domain                                                                                                                                                                      
...
  Normal  Started         2m45s  cert-manager  Challenge scheduled for processing
  Normal  Presented       2m45s  cert-manager  Presented challenge using http-01 challenge mechanism
  Normal  DomainVerified  2m22s  cert-manager  Domain &quot;yourdomain.com&quot; verified with &quot;http-01&quot; validation
</code></pre>
<p>If the status of the challenge is other than <code>DomainVerified</code>, then something went wrong while requesting the certificate from let's encrypt and will see a reason in the output.</p>
