<p>I'm using the cert-manager to manage my ssl certificates in my Kubernetes cluster. The cert-manager creates the pods and the challenges, but the challenges are never getting fulfilled. They're always saying:</p>
<blockquote>
<p>Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://somedomain/.well-known/acme-challenge/VqlmMCsb019CCFDggs03RyBLZJ0jo53LO...': Get &quot;http://somedomain/.well-known/acme-challenge/VqlmMCsb019CCFDggs03RyBLZJ0jo53LO...&quot;: EOF</p>
</blockquote>
<p>But when I open the url (http:///.well-known/acme-challenge/VqlmMCsb019CCFDggs03RyBLZJ0jo53LO...), it returns the expected code:</p>
<blockquote>
<p>vzCVdTk1q55MQCNH...zVkKYGvBJkRTvDBHQ.YfUcSfIKvWo_MIULP9jvYcgtsGxwfJMLWUGsB5kFKRc</p>
</blockquote>
<p>When I do <code>kubectl get certs</code>, it says that the certs are ready:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>NAME</th>
<th>READY</th>
<th>SECRET</th>
<th>AGE</th>
</tr>
</thead>
<tbody>
<tr>
<td>crt1</td>
<td>True</td>
<td>crt1-secret</td>
<td>65m</td>
</tr>
<tr>
<td>crt1-secret</td>
<td>True</td>
<td>crt1-secret</td>
<td>65m</td>
</tr>
<tr>
<td>crt2</td>
<td>True</td>
<td>crt2-secret</td>
<td>65m</td>
</tr>
<tr>
<td>crt2-secret</td>
<td>True</td>
<td>crt2-secret</td>
<td>65m</td>
</tr>
</tbody>
</table>
</div>
<p>It looks like Let's Encrypt never calls (or the cert-manager never instructs) these url's to verify.</p>
<p>When I list the challenges <code>kubectl describe challenges</code>, it says:</p>
<pre><code>Name:         crt-secret-hcgcf-269956107-974455061
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
API Version:  acme.cert-manager.io/v1
Kind:         Challenge
Metadata:
  Creation Timestamp:  2021-07-23T10:47:27Z
  Finalizers:
    finalizer.acme.cert-manager.io
  Generation:  1
  Managed Fields:
    API Version:  acme.cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:&quot;finalizer.acme.cert-manager.io&quot;:
        f:ownerReferences:
          .:
          k:{&quot;uid&quot;:&quot;09e39ad0-cc39-421f-80d2-07c2f82680af&quot;}:
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:authorizationURL:
        f:dnsName:
        f:issuerRef:
          .:
          f:group:
          f:kind:
          f:name:
        f:key:
        f:solver:
          .:
          f:http01:
            .:
            f:ingress:
              .:
              f:class:
              f:ingressTemplate:
    UID:                   09e39ad0-cc39-421f-80d2-07c2f82680af
  Resource Version:        19014474
  UID:                     b914ad18-2f5c-45cd-aa34-4ad7a2786536
Spec:
  Authorization URL:  https://acme-v02.api.letsencrypt.org/acme/authz-v3/1547...9301
  Dns Name:           mydomain.something
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   Issuer
    Name:   letsencrypt
  Key:      VqlmMCsb019CCFDggs03RyBLZ...nc767h_g.YfUcSfIKv...GxwfJMLWUGsB5kFKRc
  Solver:
    http01:
      Ingress:
        Class:  nginx
        Ingress Template:
          Metadata:
            Annotations:
              nginx.org/mergeable-ingress-type:  minion
        Service Type:                            ClusterIP
  Token:                                         VqlmMCsb019CC...03RyBLZJ0jo53LOiqnc767h_g
  Type:                                          HTTP-01
  URL:                                           https://acme-v02.api.letsencrypt.org/acme/chall-v3/15...49301/X--4pw
  Wildcard:                                      false
Events:                                          &lt;none&gt;
</code></pre>
<p>Any idea how I can solve this issue?</p>
<p>Update 1:</p>
<p>When I run <code>curl http://some-domain.tld/.well-known/acme-challenge/VqlmMCsb019CC...gs03RyBLZJ0jo53LOiqnc767h_g</code> in another pod, it returns:</p>
<blockquote>
<p>curl: (52) Empty reply from server</p>
</blockquote>
<p>When I do it locally (on my PC), it returns me the expected challenge-response.</p>

Nrgyzer
<p>Make sure your POD is returning something on the home URL or on the Home page of the domain that you are configuring on <strong>ingress</strong> host</p>
<p>You can also use the <strong>DNS-01</strong> method for verification if <strong>HTTP-01</strong> is not working</p>
<p>Here example for the <strong>DNS-01</strong> :</p>
<p><strong>Wild card</strong> <strong>certificate</strong> with <code>cert-manager</code> example</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: test123@gmail.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - selector:
        dnsZones:
          - &quot;devops.example.in&quot;
      dns01:
        route53:
          region: us-east-1
          hostedZoneID: Z0152EXAMPLE
          accessKeyID: AKIA5EXAMPLE
          secretAccessKeySecretRef:
            name: route53-secret
            key: secret-access-key
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef: 
    kind: Issuer
    name: letsencrypt-prod
  commonName: &quot;*.devops.example.in&quot;
  dnsNames:
    - &quot;*.devops.example.in&quot;
</code></pre>
