<p>I have been following this tutorial: <a href="https://cert-manager.io/docs/" rel="nofollow noreferrer">https://cert-manager.io/docs/</a> , and after I have installed my cert manager and made sure they are running with kubectl get pods --namespace cert-manager,</p>
<pre><code>cert-manager-5597cff495-l5hjs             1/1     Running   0          91m
cert-manager-cainjector-bd5f9c764-xrb2t   1/1     Running   0          91m
cert-manager-webhook-5f57f59fbc-q5rqs     1/1     Running   0          91m
</code></pre>
<p>I then configured my cert-manager using ACME issuer by following this tutorial <a href="https://cert-manager.io/docs/configuration/acme/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/acme/</a> .</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # You must replace this email address with your own.
    # Let's Encrypt will use this to contact you about expiring
    # certificates, and issues related to your account.
    email: aidenhsy@gmail.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource that will be used to store the account's private key.
      name: letsencrypt-staging
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
      - http01:
          ingress:
            class: nginx
</code></pre>
<p>Here is my full ingress config file:</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-srv
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: 'true'
spec:
  rules:
    - host: www.hyhaus.xyz
      http:
        paths:
          - path: /api/?(.*)
            backend:
              serviceName: devback-srv
              servicePort: 4000
          - path: /?(.*)
            backend:
              serviceName: devfront-srv
              servicePort: 3000
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: 'true'
    service.beta.kubernetes.io/do-loadbalancer-hostname: 'www.hyhaus.xyz'
  labels:
    helm.sh/chart: ingress-nginx-2.0.3
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 0.32.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/component: controller

---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # You must replace this email address with your own.
    # Let's Encrypt will use this to contact you about expiring
    # certificates, and issues related to your account.
    email: aidenhsy@gmail.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource that will be used to store the account's private key.
      name: letsencrypt-staging
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
      - http01:
          ingress:
            class: nginx
</code></pre>
<p>However when I browse to my site, the browser warns: security certificate is not trusted by your computer's operating system. And when I took a look a my certificate, it shows self-assigned, which is not really what I want. <a href="https://i.stack.imgur.com/VqbYX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VqbYX.png" alt="certificate" /></a> Am I doing something wrong here?</p>

Aidenhsy
<p>This is a certificate placeholder provided by <code>nginx ingress controller</code>. When you see it, it means there is no other (dedicated) certificate for the endpoint.</p>
<p>Now the first reason why this happened is that your <code>Ingress</code> doesn't have necessary data. Update it with this:</p>
<pre class="lang-yaml prettyprint-override"><code>metadata:
  annotations:
    # which issuer to use
    cert-manager.io/cluster-issuer: &quot;letsencrypt-staging&quot;
spec:
  tls: # placing a host in TLS config indicates that a certificate should be created
  - hosts:
    - example.org
    - www.example.org
    - xyz.example.org
    secretName: myingress-cert # cert-manager will store the created certificate in this secret
</code></pre>
<p>Documentation for ingress objects is <a href="https://cert-manager.io/docs/usage/ingress/" rel="nofollow noreferrer">here</a>.</p>
<p>If the above didn't help, try the troubleshooting steps offered by the <a href="https://cert-manager.io/docs/faq/troubleshooting/" rel="nofollow noreferrer">documentation</a>. In my experience checking <code>CertificateRequest</code> and <code>Certificate</code> resources was enough in most cases to determine the problem.</p>
<pre><code>$ kubectl get certificate
$ kubectl describe certificate &lt;certificate-name&gt;
$ kubectl get certificaterequest
$ kubectl describe certificaterequest &lt;CertificateRequest name&gt;
</code></pre>
<p>Remember that these objects are namespaced, meaning that they'll be in the same namespace as the <code>ingress</code> object.</p>
