<p>So that is what I have and what I've done... pretty much following the <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">latest documentation</a> and some tutorials I came across:</p>

<ol>
<li>Install the <code>cert-manager</code> namespace:</li>
</ol>

<pre><code>   kubectl create namespace cert-manager
</code></pre>

<ol start="2">
<li>Install <code>cert-manager</code>:</li>
</ol>

<pre><code>   kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.13.0/cert-manager.yaml
</code></pre>

<ol start="3">
<li>Verify installation... should be three running Pods and there are:</li>
</ol>

<pre><code>   kubectl get pods --namespace cert-manager
</code></pre>

<ol start="4">
<li><p><a href="https://cert-manager.io/docs/installation/kubernetes/#verifying-the-installation" rel="nofollow noreferrer">Run test</a> to make sure it is able to issue certificate types... passes.</p></li>
<li><p>Make an <code>issuer.yaml</code>:</p></li>
</ol>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: 'my@email.com'
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - http01:
          ingress:
            class: nginx
</code></pre>

<ol start="6">
<li>Make a <code>certificate.yaml</code>:</li>
</ol>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: examplewebsite-com-tls
spec:
  secretName: examplewebsite-com
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: examplewebsite.com
  dnsNames:
    - test.examplewebsite.com
  acme:
    config:
      - http01:
          ingressClass: nginx
        domains:
          - test.examplewebsite.com
</code></pre>

<ol start="7">
<li>Update <code>ingress.yaml</code> to reflect this:</li>
</ol>

<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/add-base-url: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    cert-manager.io/cluster-issuer: "letsencrypt-staging"
    nginx.ingress.kubernetes.io/ssl-redirect: 'false'
  name: ingress-service
  namespace: default
spec:
  tls:
    - hosts:
        - test.examplewebsite.com"
      secretName: examplewebsite-com
  rules:
    - host: test.examplewebsite.com
      http:
        paths:
          - path: /?(.*)
            backend:
              serviceName: client-cluster-ip-service
              servicePort: 3000
          - path: /api/?(.*)
            backend:
              serviceName: api-cluster-ip-service
              servicePort: 5000
</code></pre>

<p>Apply all of these and run into the following issues.</p>

<pre><code>$ kubectl describe certificate examplewebsite-com-tls

Status:
  Conditions:
    Last Transition Time:  2020-01-28T23:52:45Z
    Message:               Waiting for CertificateRequest "examplewebsite-com-tls-2527238951" to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Requested  117s  cert-manager  Created new CertificateRequest resource "examplewebsite-com-tls-2527238951"
</code></pre>

<p>And it just sits there indefinitely.</p>

<pre><code>$ kubectl describe secret examplewebsite-com`

Type:  kubernetes.io/tls

Data
====
ca.crt:   0 bytes
tls.crt:  0 bytes
tls.key:  1675 bytes
</code></pre>

<p>DNS is setup properly because I can navigate to the website and see the application, <code>HTTPS://</code> just doesn't work.</p>

<p>What am I doing wrong here?</p>

cjones
<p>The <code>certification.yaml</code> is not necessary at all.</p>

<p>Really, only needed this after following the installation instructions:</p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: &lt;email&gt;
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx
</code></pre>

<hr>

<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/add-base-url: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  name: ingress
  namespace: default
spec:
  tls:
    - hosts:
        - test.domain.com
      secretName: test-domain-com
  rules:
    - host: test.domain.com
      http:
        paths:
          - path: /?(.*)
            backend:
              serviceName: client-cluster-ip-service
              servicePort: 3000
          - path: /api/?(.*)
            backend:
              serviceName: api-cluster-ip-service
              servicePort: 5000

</code></pre>

<p>Very well written and current (as of 1/30/20) tutorial here:</p>

<p><a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</a></p>
