<p>I have it working on one site application I already set up and now I am just trying to replicate the exact same thing for a different site/domain in another namespace.</p>
<p>So <strong>staging.correct.com</strong> is my working https domain</p>
<p>and <strong>staging.example.com</strong> is my not working https domain (http works - just not https)</p>
<p>When I do the following it shows 3 certs, the working one for correct and then 2 for the example.com when it should only have one for example:</p>
<p><strong>kubectl get -A certificate</strong></p>
<pre><code>correct         staging-correct-com           True    staging-correct-com-tls   10d
example   staging-example-com           False   staging-example-com-tls   16h
example   staging-example-website-com   False   staging-example-com-tls   17h
</code></pre>
<p>When I do:
<strong>kubectl get -A certificaterequests</strong>
It shows 2 certificate requests for the example</p>
<pre><code>example   staging-example-com-nl46v           False   15h
example   staging-example-website-com-plhqb   False   15h
</code></pre>
<p>When I do:
<strong>kubectl get ingressroute -A</strong></p>
<pre><code>NAMESPACE       NAME                                         AGE
correct         correct-ingress-route                        10d
correct         correct-secure-ingress-route                 6d22h
kube-system     traefik-dashboard                            26d
example   example-website-ingress-route          15h
example   example-website-secure-ingress-route   15h
routing         dashboard                                    29d
routing         traefik-dashboard                            6d21h
</code></pre>
<p>When I do:
<strong>kubectl get secrets -A</strong>   (just showing the relevant ones)</p>
<pre><code>correct           default-token-bphcm                       kubernetes.io/service-account-token 
correct           staging-correct-com-tls             kubernetes.io/tls 

example     default-token-wx9tx                       kubernetes.io/service-account-token   
example     staging-example-com-tls             Opaque                               
example     staging-example-com-wf224           Opaque                                
example     staging-example-website-com-rzrvw   Opaque   
</code></pre>
<p><strong>Logs from cert manager pod:</strong></p>
<p>1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress &quot;msg&quot;=&quot;found one existing HTTP01 solver ingress&quot; &quot;dnsName&quot;=&quot;staging.example.com&quot; &quot;related_resource_kind&quot;=&quot;Ingress&quot; &quot;related_resource_name&quot;=&quot;cm-acme-http-solver-bqjsj&quot; &quot;related_resource_namespace”=“example” &quot;related_resource_version&quot;=&quot;v1beta1&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;staging-example-com-ltjl6-1661100417-771202110&quot; &quot;resource_namespace”=“example” &quot;resource_version&quot;=&quot;v1&quot; &quot;type&quot;=&quot;HTTP-01&quot;</p>
<p>When I do:
<strong>kubectl get challenge -A</strong></p>
<pre><code>example   staging-example-com-nl46v-1661100417-2848337980                   staging.example.com   15h
example   staging-example-website-com-plhqb-26564845-3987262508   pending   staging.example.com 
</code></pre>
<p>When I do: <strong>kubectl get order -A</strong></p>
<pre><code>NAMESPACE       NAME                                               STATE     AGE
example   staging-example-com-nl46v-1661100417         pending   17h
example   staging-example-website-com-plhqb-26564845   pending   17h
</code></pre>
<p>My yml files:</p>
<p><strong>My ingress route:</strong></p>
<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  namespace: example
  name: example-website-ingress-route
annotations:
  kubernetes.io/ingress.class: &quot;traefik&quot;
  cert-manager.io/issuer: example-issuer-staging
  traefik.ingress.kubernetes.io/router.entrypoints: web
  traefik.frontend.redirect.entryPoint: https
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`staging.example.com`)
      middlewares:
        - name: https-only
      kind: Rule
      services:
        - name: example-website
          namespace: example
          port: 80
</code></pre>
<p><strong>my issuer:</strong></p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: example-issuer-staging
  namespace: example
spec:
  acme:
    # The ACME server  URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: example@example.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: staging-example-com-tls
    # Enable the HTTP-01 challenge  provider
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - http01:
        ingress:
          class: traefik
</code></pre>
<p><strong>my middleware:</strong></p>
<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: https-only
  namespace: example
spec:
  redirectScheme:
    scheme: https
    permanent: true
</code></pre>
<p><strong>my secure ingress route:</strong></p>
<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  namespace: example
  name: example-website-secure-ingress-route
annotations:
  kubernetes.io/ingress.class: &quot;traefik&quot;
  cert-manager.io/issuer: example-issuer-staging
  traefik.ingress.kubernetes.io/router.entrypoints: websecure
  traefik.frontend.redirect.entryPoint: https
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`staging.example.com`)
      kind: Rule
      services:
        - name: example-website
          namespace: example
          port: 80
  tls:
    domains:                      
    - main: staging.example.com
    options:
      namespace: example
    secretName: staging-example-com-tls
</code></pre>
<p><strong>my service:</strong></p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  namespace: example
  name: 'example-website'
spec:
  type: ClusterIP
  ports:
    - protocol: TCP
      name: http
      port: 80
      targetPort: 80
    - protocol: TCP
      name: https
      port: 443
      targetPort: 80
  selector:
    app: 'example-website'
</code></pre>
<p><strong>my solver:</strong></p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: staging-example-com
  namespace: example
spec:
  secretName: staging-example-com-tls
  issuerRef:
    name: example-issuer-staging
    kind: Issuer
  commonName: staging.example.com
  dnsNames:
  - staging.example.com
</code></pre>
<p><strong>my app:</strong></p>
<pre><code>apiVersion: apps/v1
kind: ReplicaSet
metadata:
  namespace: example
  name: 'example-website'
  labels:
    app: 'example-website'
    tier: 'frontend'
spec:
  replicas: 1
  selector:
    matchLabels:
      app: 'example-website'
  template:
    metadata:
      labels:
        app: 'example-website'
    spec:
      containers:
      - name: example-website-container
        image: richarvey/nginx-php-fpm:1.10.3 
        imagePullPolicy: Always
        env:
          - name: SSH_KEY
            value: 'secret'
          - name: GIT_REPO
            value: 'url of source code for site'
          - name: GIT_EMAIL
            value: 'example@example.com'
          - name: GIT_NAME
            value: 'example'
        ports:
        - containerPort: 80
  
</code></pre>
<p>How can I delete all these secrets, orders, certificates and stuff in the example namespace and try again? Does cert-manager let you do this without restarting them continuously?</p>
<p>EDIT:</p>
<p>I deleted the namespace and redeployed, then:</p>
<p><strong>kubectl describe certificates staging-example-com -n example</strong></p>
<pre><code>Spec:
  Common Name:  staging.example.com
  Dns Names:
    staging.example.com
  Issuer Ref:
    Kind:       Issuer
    Name:       example-issuer-staging
  Secret Name:  staging-example-com-tls

Status:
  Conditions:
    Last Transition Time:        2020-09-26T21:25:06Z
    Message:                     Issuing certificate as Secret does not contain a certificate
    Reason:                      MissingData
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2020-09-26T21:25:07Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  staging-example-com-gnbl4

Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Issuing    3m10s  cert-manager  Issuing certificate as Secret does not exist
  Normal  Reused     3m10s  cert-manager  Reusing private key stored in existing Secret resource &quot;staging-example-com-tls&quot;
  Normal  Requested  3m9s   cert-manager  Created new CertificateRequest resource &quot;staging-example-com-qrtfx&quot;
</code></pre>
<p>So then I did:</p>
<p><strong>kubectl describe certificaterequest staging-example-com-qrtfx -n example</strong></p>
<pre><code>Status:
  Conditions:
    Last Transition Time:  2020-09-26T21:25:10Z
    Message:               Waiting on certificate issuance from order example/staging-example-com-qrtfx-1661100417: &quot;pending&quot;
    Reason:                Pending
    Status:                False
    Type:                  Ready

Events:
  Type    Reason        Age    From          Message
  ----    ------        ----   ----          -------
  Normal  OrderCreated  8m17s  cert-manager  Created Order resource example/staging-example-com-qrtfx-1661100417
  Normal  OrderPending  8m17s  cert-manager  Waiting on certificate issuance from order example/staging-example-com-qrtfx-1661100417: &quot;&quot;
</code></pre>
<p>So I did:</p>
<p><strong>kubectl describe challenges staging-example-com-qrtfx-1661100417 -n example</strong></p>
<pre><code>Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '404', expected '200'
  State:       pending

Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Started    11m   cert-manager  Challenge scheduled for processing
  Normal  Presented  11m   cert-manager  Presented challenge using HTTP-01 challenge mechanism
</code></pre>

Jacob
<p>I figured it out. The issue seems to be that IngressRoute (which is used in traefik) does not work with cert mananger. I just deployed this file, then the http check was confirmed, then I could delete it again. Hope this helps others with same issue.</p>
<p>Seems cert manager does support IngressRoute which is in Traefik? I opened the issue here so let's see what they say: <a href="https://github.com/jetstack/cert-manager/issues/3325" rel="nofollow noreferrer">https://github.com/jetstack/cert-manager/issues/3325</a></p>
<pre><code>kubectl apply -f example-ingress.yml
</code></pre>
<p>File:</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  namespace: example
  name: example-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;traefik&quot;
    cert-manager.io/issuer: example-issuer-staging
spec:
  rules:
  - host: staging.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: example-website
          servicePort: 80
  tls:
  - hosts:
    - staging.example.com
    secretName: staging-example-com-tls
</code></pre>
