<p>I have configured a ClusterIssuer</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    email: &lt;myemail&gt;
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-cluster-issuer-key
    solvers:
      - http01:
          ingress:
            class: nginx
</code></pre>
<p>and An Ingress</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
    kubernetes.io/ingress.class: nginx
  name: web-ingress
  namespace: default
spec:
  rules:
    - host: hostname
      http:
        paths:
          - backend:
              service:
                name: web-service
                port:
                  number: 3000
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - hostname
      secretName: web-cert-tls
</code></pre>
<p>I'm unable to get the configuration to run properly. This spawns a new ingress as follows</p>
<pre><code>Name:             cm-acme-http-solver-9nbh6
Labels:           acme.cert-manager.io/http-domain=1234
                  acme.cert-manager.io/http-token=1234
                  acme.cert-manager.io/http01-solver=true
Namespace:        default
Address:          &lt;IPAddress&gt;
Ingress Class:    &lt;none&gt;
Default backend:  &lt;default&gt;
Rules:
  Host          Path  Backends
  ----          ----  --------
  hostname  
                /.well-known/acme-challenge/challengexyzxyzxyz-o   cm-acme-http-solver-9dc8z:8089 (10.2.0.85:8089)
Annotations:    kubernetes.io/ingress.class: nginx
                nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
Events:
  Type    Reason  Age                From                      Message
  ----    ------  ----               ----                      -------
  Normal  Sync    10m (x2 over 10m)  nginx-ingress-controller  Scheduled for sync

</code></pre>
<p>Here's the describe for Ingress which is applied by me</p>
<pre><code>Name:             web-ingress
Labels:           app.kubernetes.io/instance=web-app
Namespace:        default
Address:          &lt;IPAddress&gt;
Ingress Class:    &lt;none&gt;
Default backend:  &lt;default&gt;
TLS:
  web-cert-tls terminates hostname
Rules:
  Host          Path  Backends
  ----          ----  --------
  hostname  
                /   web-service:3000 (10.2.0.68:3000)
Annotations:    acme.cert-manager.io/http01-edit-in-place: true
                cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
                kubernetes.io/ingress.class: nginx
Events:
  Type    Reason             Age                  From                       Message
  ----    ------             ----                 ----                       -------
  Normal  CreateCertificate  31m                  cert-manager-ingress-shim  Successfully created Certificate &quot;web-cert-tls&quot;
  Normal  Sync               6m27s (x6 over 31m)  nginx-ingress-controller   Scheduled for sync
</code></pre>
<p>and when I check the cert-manager logs I find this error</p>
<pre><code>E0905 10:09:04.617600       1 sync.go:190] cert-manager/challenges &quot;msg&quot;=&quot;propagation check failed&quot; &quot;error&quot;=&quot;did not get expected response when querying endpoint, expected \&quot;challengexyzxyz.morestuffherexyzxyz\&quot; but got: &lt;html xml:lang=\&quot;fr-FR\&quot; l... (truncated)&quot; &quot;dnsName&quot;=&quot;hostname.ovh&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;web-cert-tls-xtp2r-768063107-2100049723&quot; &quot;resource_namespace&quot;=&quot;default&quot; &quot;resource_version&quot;=&quot;v1&quot; &quot;type&quot;=&quot;HTTP-01&quot;

</code></pre>
<p>When I access <code>hostname/.well-known/acme-challenge/challengexyzxyzxyz-o</code> from browser
I'm getting the expected value.</p>
<p>When I access it from a pod I'm getting an html that says domain purchased page.</p>
<p>I've also tried to just apply the certificate without the Ingress</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: web-cert
  namespace: default
spec:
  dnsNames:
    - hostname.ovh
  secretName: web-cert-tls
  issuerRef:
    name: letsencrypt-cluster-issuer
    kind: ClusterIssuer
</code></pre>
<p>I've also tried adding <code>acme.cert-manager.io/http01-edit-in-place: &quot;true&quot;</code> to Ingress object annotation, It didnt solve the problem either. ( It didnt spawn a new ingress that's all )</p>
<p>so I'm stuck at this stage of challenge</p>
<pre><code>Type:         HTTP-01
  URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/12134567898/Fmasf
  Wildcard:     false
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: did not get expected response when querying endpoint, expected &quot;challengexyzxyzxyz-o.challengexyzxyzxyz-o&quot; but got: &lt;html xml:lang=&quot;fr-FR&quot; l... (truncated)
  State:       pending
</code></pre>

Adharsh M
<pre><code>      dnsPolicy: &quot;None&quot;
      dnsConfig:
        nameservers:
          - 8.8.8.8
          - 8.8.4.4
</code></pre>
<p>Setting this config for cert-manager worked out.</p>
<p>It was <code>dnsPolicy: ClusterFirst</code> And it somehow was pointing to dns provider's website saying congrats on purchase.</p>
<p>Turns out that, it also can be a propagation delay for the dns that's local to the k8s provider. In my case the delay was more than 24h. Once the nameserver was updated I could revert this change and still got it to work.</p>
