<p>I'm quite new to Kubernetes. But so far was able to configure an AKS (Azure Kubernetes Services) cluster. I have multiple namespaces for my services (Dev, stage, prod). And configured an Ingress service using nginx (<strong>into it's own namespace 'ingress-nginx'</strong>). The setup works perfectly with HTTP. </p>

<p>My problems started when I tried to use HTTPS. First installed cert-manager by using <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer"><strong>this</strong></a> script. It has <strong>created it own namespace again: 'cert-manager'</strong> <strong>I was not using HELM just regular manifest</strong>. Also followed MS Azure <a href="https://cert-manager.io/docs/configuration/acme/dns01/azuredns/" rel="nofollow noreferrer"><strong>DNS config</strong></a>.</p>

<p>Everything seems correct I have my services, secrets, clusterIssuer, etc. Even challenge created in Azure DNS Zone. You can see it on Azure portal. But I did not get any certificate.</p>

<p><a href="https://i.stack.imgur.com/pMHQI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pMHQI.png" alt="enter image description here"></a></p>

<p>ClusterIssuer config:</p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: 8b3s-org-letsencrypt
spec:
  acme:
    #server: https://acme-v02.api.letsencrypt.org/directory
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: &lt;...@gmail.com&gt;
    privateKeySecretRef:
      name: 8b3s-org-letsencrypt-key
    solvers:
    - selector:
      dns01:
        azuredns:
          clientID: ....
          clientSecretSecretRef:
          # The following is the secret we created in Kubernetes. Issuer will use this to present challenge to Azure DNS.
            name: azuredns-config
            key: client-secret
          subscriptionID: ....
          tenantID: "...."
          resourceGroupName: Web
          hostedZoneName: 8b3s.org
          # Azure Cloud Environment, default to AzurePublicCloud
          environment: AzurePublicCloud
</code></pre>

<p>Ingress config:</p>

<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: 8b3s-virtual-host-ingress
  namespace: ingress-nginx
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: "8b3s-org-letsencrypt"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/tls-acme: "true"
spec:
  tls:
  - hosts:
     - '*.8b3s.org'
    secretName: 8b3s-org-letsencrypt-tls
  rules:
  - host: dev.8b3s.org
    http:
      paths:
      - path: /
        backend:
          serviceName: the8b3swebsite-development-ext
          servicePort: 8080
</code></pre>

<p>So the issue is every config seems OK but there is no Cert at all. <strong>I got only an 'Opaque' ' tls.key:
1679 bytes' as '8b3s-org-letsencrypt-key' in the 'cert-manager' namespace.</strong></p>

<p><a href="https://i.stack.imgur.com/wdZer.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wdZer.png" alt="enter image description here"></a></p>

<p>The <strong>Cert got created for the 'ingress-nginx' namespaces '8b3s-org-letsencrypt-tls' as type 'kubernetes.io/tls'. But 'ca.crt: 0 bytes' and 'tls.crt: 0 bytes'</strong>.</p>

<p><a href="https://i.stack.imgur.com/6LWoR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6LWoR.png" alt="enter image description here"></a></p>

<p>I was also looking into cert-manager pods output. Found those 2 logs weird (if needed I have the full logs):</p>

<pre><code>I0222 22:51:00.067791       1 acme.go:201] cert-manager/controller/certificaterequests-issuer-acme/sign "msg"="acme Order resource is not in a ready state, waiting..." "related_resource_kind"="Order" "related_resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645" "related_resource_namespace"="ingress-nginx" "resource_kind"="CertificateRequest" "resource_name"="8b3s-org-letsencrypt-tls-1807766204" "resource_namespace"="ingress-nginx" 

I0222 22:51:00.068069       1 sync.go:129] cert-manager/controller/orders "msg"="Creating additional Challenge resources to complete Order" "resource_kind"="Order" "resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645" "resource_namespace"="ingress-nginx" 

E0222 22:51:01.876182       1 sync.go:184] cert-manager/controller/challenges "msg"="propagation check failed" "error"="DNS record for \"8b3s.org\" not yet propagated" "dnsName"="8b3s.org" "resource_kind"="Challenge" "resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645-481622463" "resource_namespace"="ingress-nginx" "type"="dns-01" 
</code></pre>

<p>Any idea what can be the problem?</p>

<p><strong>UPDATE:</strong>
Added Azure NS records to my domain DNS as suggested. Waited an hour or so but there is no effect... Deleted existing CA secrets, restarted all Nginx, cert-manager Pods. And noticed the following error:</p>

<pre><code>E0225 10:14:03.671099       1 util.go:71] cert-manager/controller/certificaterequests/handleOwnedResource "msg"="error getting order referenced by resource" "error"="certificaterequest.cert-manager.io \"8b3s-org-letsencrypt-tls-1807766204\" not found" "related_resource_kind"="CertificateRequest" "related_resource_name"="8b3s-org-letsencrypt-tls-1807766204" "related_resource_namespace"="ingress-nginx" "resource_kind"="Order" "resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645" "resource_namespace"="ingress-nginx" 
E0225 10:14:03.674679       1 util.go:71] cert-manager/controller/certificates/handleOwnedResource "msg"="error getting order referenced by resource" "error"="certificate.cert-manager.io \"8b3s-org-letsencrypt-tls\" not found" "related_resource_kind"="Certificate" "related_resource_name"="8b3s-org-letsencrypt-tls" "related_resource_namespace"="ingress-nginx" "resource_kind"="CertificateRequest" "resource_name"="8b3s-org-letsencrypt-tls-1807766204" "resource_namespace"="ingress-nginx" 
</code></pre>

Major
<p>The <a href="https://whois.domaintools.com/8b3s.org" rel="nofollow noreferrer">whois record</a> for your domain shows that it is still pointed at <code>NS57.DOMAINCONTROL.COM</code> and not the 4 Azure DNS resolvers you show in your screenshot. Thus, Let's Encrypt has no way of knowing they should use Azure to look up that <code>_acme-challenge</code> record, and it fails.</p>
