<p>I want to use cert-manager for issuing my own SSL certificate on AKS.</p>

<p>I already have a signed certificate (<a href="https://www.quovadisglobal.de/Zertifikate/SSLCertificates/BusinessSSLCertificates.aspx" rel="nofollow noreferrer">https://www.quovadisglobal.de/Zertifikate/SSLCertificates/BusinessSSLCertificates.aspx</a>) which I want to use. In the docs of cert-manager, I find only two relevant Solutions.
<a href="https://cert-manager.io/docs/configuration/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/</a></p>

<p><strong>SelfSigned</strong>: This should be used to sign a certificate by a CSR.</p>

<p><strong>CA</strong>: This should be used to sign incoming certificate requests.</p>

<p>I tried the second one. Here what I did:</p>

<p><strong>Install and verify cert-manager:</strong></p>

<pre><code>$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.12.0/cert-manager.yaml
$ kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-7c5748846c-b4nqb             1/1     Running   0          2d23h
cert-manager-cainjector-7b5965856-bgk4g   1/1     Running   1          2d23h
cert-manager-webhook-5759dd4547-mlgjs     1/1     Running   0          2d23h
</code></pre>

<p><strong>Create Secret from private key and cert:</strong></p>

<pre><code>$ sudo kubectl create secret tls ssl-secret-p --cert=mycert.crt --key=mykey.key --namespace=cert-manager
</code></pre>

<p>Create issuer:</p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: ca-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: ssl-secret-p
</code></pre>

<p><strong>Error:</strong></p>

<pre><code>$ sudo kubectl get clusterissuers ca-issuer -n cert-manager -o wide

NAME        READY   STATUS                                                         AGE
ca-issuer   False   Error getting keypair for CA issuer: certificate is not a CA   5m
</code></pre>

<p>What I'm doing wrong?</p>

<p><strong>EDIT:</strong></p>

<pre><code>sudo kubectl -n namespace get ing
NAME            HOSTS           ADDRESS          PORTS     AGE
nginx-ingress   ***.com         51.105.205.128   80, 443   13m
</code></pre>

Nico Schuck
<p>Cert manager will carry out the acme challenge verification, try passing this secret name to the tls in the ingress rule, once the acme challenge appears valid, you will see a corresponding entry in ingress </p>

<pre><code>kubectl -n namespace get ing
</code></pre>

<p>will give you that.</p>

<p>Then the certificate shall acquire ready state</p>

<p>I tried it, but I haven't used any pre-created tls secret. You can refer <a href="https://stackoverflow.com/questions/58423312/how-do-i-test-a-clusterissuer-solver/58436097?noredirect=1#comment103215785_58436097">this stackoverflow post</a>, I guess it turns up somewhat helpful to you</p>
