<p>I am following this <a href="https://cert-manager.io/docs/tutorials/acme/nginx-ingress/" rel="nofollow noreferrer">tutorial</a> to use a trusted TLS certificate in my ingress rules. All works, however</p>
<pre><code>kubectl describe certificate quickstart-example-tls
</code></pre>
<p>gives &amp; gets stuck at <em>Created new CertificateRequest resource</em></p>
<pre><code>....
Status:
  Conditions:
    Last Transition Time:        2022-02-08T10:00:01Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2022-02-08T10:00:02Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  quickstart-example-tls-d87r6
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Issuing    21m   cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  21m   cert-manager  Stored new private key in temporary Secret resource &quot;quickstart-example-tls-d87r6&quot;
  Normal  Requested  21m   cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-kxwqd&quot;

</code></pre>
<p>First let me share my ingress rules and Issuers:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: flask-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: www.&lt;Domain&gt;.net
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: flask
            port:
              number: 5000
</code></pre>
<p>I set up DNS (in digital ocean) rules so curling (via web) works.</p>
<pre><code>curl &quot;http://www.&lt;Domain&gt;.net&quot;                                                                   
&lt;p&gt;Hello, World!&lt;/p&gt;%    
</code></pre>
<p>Here my issuer file:</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-staging
  namespace: default
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: &lt;MY-EMAIL&gt;
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    - http01:
        ingress:
          class: nginx
</code></pre>
<pre><code># kubectl get issuer
NAME                  READY   AGE
letsencrypt-staging   True    26s

</code></pre>
<p>Now I update my ingress rule and start the challenge:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: flask-ingress
  annotations:
    cert-manager.io/issuer: letsencrypt-staging
spec:
  tls:
  - hosts:
     - www.&lt;DOMAIN&gt;.net
    secretName: quickstart-example-tls
  ingressClassName: nginx
  rules:
  - host: www.&lt;DOMAIN&gt;.net
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: flask
            port:
              number: 5000
</code></pre>
<pre><code>#kubectl get certificate                 
NAME                     READY   SECRET                   AGE
quickstart-example-tls   False   quickstart-example-tls   88s
</code></pre>
<p>Here the detailed output:</p>
<pre><code>#kubectl describe certificate quickstart-example-tls
Name:         quickstart-example-tls
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
API Version:  cert-manager.io/v1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2022-02-08T10:34:40Z
  Generation:          1
  Managed Fields:
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:ownerReferences:
          .:
          k:{&quot;uid&quot;:&quot;&lt;UID&gt;&quot;}:
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:dnsNames:
        f:issuerRef:
          .:
          f:group:
          f:kind:
          f:name:
        f:secretName:
        f:usages:
      f:status:
        .:
        f:conditions:
        f:nextPrivateKeySecretName:
    Manager:    controller
    Operation:  Update
    Time:       2022-02-08T10:34:41Z
  Owner References:
    API Version:           networking.k8s.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  flask-ingress
    UID:                   &lt;UID&gt;
  Resource Version:        321990
  UID:                     &lt;UID&gt;
Spec:
  Dns Names:
    www.&lt;DOMAIN&gt;.net
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       Issuer
    Name:       letsencrypt-staging
  Secret Name:  quickstart-example-tls
  Usages:
    digital signature
    key encipherment
Status:
  Conditions:
    Last Transition Time:        2022-02-08T10:34:40Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
    Last Transition Time:        2022-02-08T10:34:40Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
  Next Private Key Secret Name:  quickstart-example-tls-w4psf
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Issuing    2m14s  cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  2m13s  cert-manager  Stored new private key in temporary Secret resource &quot;quickstart-example-tls-w4psf&quot;
  Normal  Requested  2m13s  cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-znhlv&quot;
</code></pre>
<p>So this is were things get stucked and IDK why.</p>
<pre><code># kubectl describe certificaterequest quickstart-example-tls
Name:         quickstart-example-tls-znhlv
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  cert-manager.io/certificate-name: quickstart-example-tls
              cert-manager.io/certificate-revision: 1
              cert-manager.io/private-key-secret-name: quickstart-example-tls-w4psf
API Version:  cert-manager.io/v1
Kind:         CertificateRequest
Metadata:
  Creation Timestamp:  2022-02-08T10:34:41Z
  Generate Name:       quickstart-example-tls-
  Generation:          1
  Managed Fields:
    API Version:  cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:cert-manager.io/certificate-name:
          f:cert-manager.io/certificate-revision:
          f:cert-manager.io/private-key-secret-name:
        f:generateName:
        f:ownerReferences:
          .:
          k:{&quot;uid&quot;:&quot;&lt;UID&gt;&quot;}:
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:issuerRef:
          .:
          f:group:
          f:kind:
          f:name:
        f:request:
        f:usages:
      f:status:
        .:
        f:conditions:
    Manager:    controller
    Operation:  Update
    Time:       2022-02-08T10:34:41Z
  Owner References:
    API Version:           cert-manager.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Certificate
    Name:                  quickstart-example-tls
    UID:                   &lt;UID&gt;
  Resource Version:        322003
  UID:                     &lt;UID&gt;
Spec:
  Extra:
    authentication.kubernetes.io/pod-name:
      cert-manager-6d8d028374dbb-f43n7
    authentication.kubernetes.io/pod-uid:
      &lt;UID&gt;
  Groups:
    system:serviceaccounts
    system:serviceaccounts:cert-manager
    system:authenticated
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   Issuer
    Name:   letsencrypt-staging
  Request:  &lt;Request ID&gt;
  UID:      &lt;UID&gt;
  Usages:
    digital signature
    key encipherment
  Username:  system:serviceaccount:cert-manager:cert-manager
Status:
  Conditions:
    Last Transition Time:  2022-02-08T10:34:41Z
    Message:               Certificate request has been approved by cert-manager.io
    Reason:                cert-manager.io
    Status:                True
    Type:                  Approved
    Last Transition Time:  2022-02-08T10:34:43Z
    Message:               Waiting on certificate issuance from order default/quickstart-example-tls-znhlv-138543614: &quot;pending&quot;
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:
  Type    Reason           Age    From          Message
  ----    ------           ----   ----          -------
  Normal  cert-manager.io  4m54s  cert-manager  Certificate request has been approved by cert-manager.io
  Normal  OrderCreated     4m53s  cert-manager  Created Order resource default/quickstart-example-tls-znhlv-138543614
</code></pre>
<p>Having a look at the challenge, all seems to work.</p>
<pre><code># kubectl describe challenges --all-namespaces
Name:         quickstart-example-tls-znhlv-138543614-1891152753
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
API Version:  acme.cert-manager.io/v1
Kind:         Challenge
Metadata:
  Creation Timestamp:  2022-02-08T10:34:44Z
  Finalizers:
    finalizer.acme.cert-manager.io
  Generation:  1
  Managed Fields:
    API Version:  acme.cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:&quot;finalizer.acme.cert-manager.io&quot;:
        f:ownerReferences:
          .:
          k:{&quot;uid&quot;:&quot;&lt;UID&gt;&quot;}:
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:authorizationURL:
        f:dnsName:
        f:issuerRef:
          .:
          f:group:
          f:kind:
          f:name:
        f:key:
        f:solver:
          .:
          f:http01:
            .:
            f:ingress:
              .:
              f:class:
        f:token:
        f:type:
        f:url:
        f:wildcard:
      f:status:
        .:
        f:presented:
        f:processing:
        f:reason:
        f:state:
    Manager:    controller
    Operation:  Update
    Time:       2022-02-08T10:34:46Z
  Owner References:
    API Version:           acme.cert-manager.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Order
    Name:                  quickstart-example-tls-znhlv-138543614
    UID:                   &lt;UID&gt;
  Resource Version:        322038
  UID:                     &lt;UID&gt;
Spec:
  Authorization URL:  https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/&lt;NR&gt;
  Dns Name:           www.&lt;DOMAIN&gt;.net
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   Issuer
    Name:   letsencrypt-staging
  Key:      &lt;SOMEKEY&gt;
  Solver:
    http01:
      Ingress:
        Class:  nginx
  Token:        &lt;SOMEToken&gt;
  Type:         HTTP-01
  URL:          https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/&lt;NR&gt;/&lt;CODE&gt;
  Wildcard:     false
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://www.&lt;DOMAIN&gt;.net/.well-known/acme-challenge/&lt;SOMEToken&gt;': Get &quot;http://www.&lt;DOMAIN&gt;.net/.well-known/acme-challenge/&lt;SOMEToken&gt;&quot;: EOF
  State:       pending
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Started    6m18s  cert-manager  Challenge scheduled for processing
  Normal  Presented  6m17s  cert-manager  Presented challenge using HTTP-01 challenge mechanism

</code></pre>
<pre><code>#curl &quot;http://www.&lt;DOMAIN&gt;.net/.well-known/acme-challenge/&lt;SOMEToken&gt;&quot;
&lt;SOMEKEY&gt;%  
</code></pre>
<p>All seems to be fine, but I do not get the certificate?</p>
<p>A couple of additional things:</p>
<ul>
<li>I use digital ocean managed kubernetes 1.21</li>
<li>I installed ingress-nginx via UI in digital ocean to namespace ingress-nginx</li>
<li>I use cert-manager 1.7</li>
</ul>
<pre><code>#kubectl get pods -n cert-manager
NAME                                     READY   STATUS    RESTARTS   AGE
cert-manager-6d8d6b5dbb-f4xn7            1/1     Running   0          47h
cert-manager-cainjector-d6cbc4d9-g6j8c   1/1     Running   0          47h
cert-manager-webhook-85fb68c79b-sv8pb    1/1     Running   0          47h
</code></pre>
<p>Looking add the logs from cert-manager, I get that get request failed although it works actually.</p>
<pre><code># kubectl logs cert-manager-6d8d6b5dbb-f4xn7 -n cert-manager 
E0208 15:07:31.660877       1 sync.go:186] cert-manager/challenges &quot;msg&quot;=&quot;propagation check failed&quot; &quot;error&quot;=&quot;failed to perform self check GET request 'http://www.&lt;DOMAIN&gt;.net/.well-known/acme-challenge/&lt;SOMEToken&gt;': Get \&quot;http://www.&lt;DOMAIN&gt;.net/.well-known/acme-challenge/&lt;SOMEToken&gt;\&quot;: EOF&quot; &quot;dnsName&quot;=&quot;www.&lt;DOMAIN&gt;.net&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;quickstart-example-tls-znhlv-138543614-1891152753&quot; &quot;resource_namespace&quot;=&quot;default&quot; &quot;resource_version&quot;=&quot;v1&quot; &quot;type&quot;=&quot;HTTP-01&quot; 
</code></pre>

Henrik
<p>@Rychu linked me to the <a href="https://www.digitalocean.com/community/questions/how-do-i-correct-a-connection-timed-out-error-during-http-01-challenge-propagation-with-cert-manager" rel="nofollow noreferrer">answer</a> here. This goes also back to this post <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes#step-5-enabling-pod-communication-through-the-load-balancer-optional" rel="nofollow noreferrer">step 5</a></p>
<p>For my case I did</p>
<p><strong>Added a DNS entry</strong> on <a href="https://docs.digitalocean.com/products/networking/dns/how-to/add-domains/" rel="nofollow noreferrer">digital ocean</a> for &quot;<em>workaround.&lt;&quot;DOMAIN&quot;&gt;.net</em>&quot; to point to my load balancer and then I <strong>updated my ingress_controller</strong>:</p>
<pre><code>cat ingress_nginx_svc.yaml
</code></pre>
<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: 'true'
    service.beta.kubernetes.io/do-loadbalancer-hostname: &quot;workaround.&lt;DOMAIN&gt;.net&quot;
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 1.0.4
    helm.sh/chart: ingress-nginx-4.0.6
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  externalTrafficPolicy: Cluster
  ports:
  - appProtocol: http
    name: http
    nodePort: 31799
    port: 80
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    nodePort: 32533
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: LoadBalancer
</code></pre>
<pre><code>kubectl apply -f ingress_nginx_svc.yaml
</code></pre>
<p>Then you should see something like this</p>
<pre><code># kubectl describe certificate  
  Type    Reason     Age                  From          Message
  ----    ------     ----                 ----          -------
  Normal  Issuing    15m                  cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  15m                  cert-manager  Stored new private key in temporary Secret resource &quot;quickstart-example-tls-zj57f&quot;
  Normal  Requested  15m                  cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-gc599&quot;
  Normal  Issuing    8m3s                 cert-manager  Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/letsencrypt-staging
  Normal  Reused     8m2s                 cert-manager  Reusing private key stored in existing Secret resource &quot;quickstart-example-tls&quot;
  Normal  Requested  8m2s                 cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-55xcw&quot;
  Normal  Issuing    7m33s (x2 over 11m)  cert-manager  The certificate has been successfully issued
</code></pre>
<p>That solved my problem! Thanks again @Rychu for pointing me to that</p>
