<p>I have installed on my K8S <a href="https://cert-manager.io" rel="nofollow noreferrer">https://cert-manager.io</a> and have created cluster issuer:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: digitalocean-dns
  namespace: cert-manager
data:
  # insert your DO access token here
  access-token: secret

---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    email: mail@example.io
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: secret
    solvers:
      - dns01:
          digitalocean:
            tokenSecretRef:
              name: digitalocean-dns
              key: access-token
        selector:
          dnsNames:
            - "*.tool.databaker.io"
            #- "*.service.databaker.io"
---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: mail@example.io
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: secret
    solvers:
      - dns01:
          digitalocean:
            tokenSecretRef:
              name: digitalocean-dns
              key: access-token
        selector:
          dnsNames:
            - "*.tool.databaker.io"  
</code></pre>

<p>also have created a certificate: </p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: hello-cert
spec:
  secretName: hello-cert-prod
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: "*.tool.databaker.io"
  dnsNames:
    - "*.tool.databaker.io"
</code></pre>

<p>and it was successfully created:</p>

<pre><code>Normal  Requested  8m31s  cert-manager  Created new CertificateRequest resource "hello-cert-2824719253"
  Normal  Issued     7m22s  cert-manager  Certificate issued successfully 
</code></pre>

<p>To figure out, if the certificate is working, I have deployed a service:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: hello-kubernetes-first
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: hello-kubernetes-first
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-kubernetes-first
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hello-kubernetes-first
  template:
    metadata:
      labels:
        app: hello-kubernetes-first
    spec:
      containers:
        - name: hello-kubernetes
          image: paulbouwer/hello-kubernetes:1.7
          ports:
            - containerPort: 8080
          env:
            - name: MESSAGE
              value: Hello from the first deployment!
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-kubernetes-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  rules:
    - host: hello.tool.databaker.io
      http:
        paths:
          - backend:
              serviceName: hello-kubernetes-first
              servicePort: 80
---
</code></pre>

<p>But it does not work properly.</p>

<p><a href="https://i.stack.imgur.com/plF2L.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/plF2L.png" alt="enter image description here"></a></p>

<p>What am I doing wrong?</p>

softshipper
<p>You haven't specified the secrets containing your certificate:</p>

<pre><code>spec:
  tls:
  - hosts:
    - hello.tool.databaker.io
    secretName: &lt;secret containing the certificate&gt;
  rules:
   ...
</code></pre>
