<p>I am trying to integrate ISTIO with cert manager following the docs here:
<a href="https://istio.io/latest/docs/ops/integrations/certmanager/" rel="nofollow noreferrer">https://istio.io/latest/docs/ops/integrations/certmanager/</a></p>
<p>But I got the error saying:</p>
<pre><code>Waiting for HTTP-01 challenge propagation:
failed to perform self check GET request 'http://&lt;domain&gt;/.well-known/acme-challenge/rhLUqegNfgpWkwIlKDUTunTbD_DTwrH4oRvtHKkNJZs': 
Get &quot;http://&lt;domain&gt;/.well-known/acme-challenge/rhLUqegNfgpWkwIlKDUTunTbD_DTwrH4oRvtHKkNJZs&quot;:
dial tcp &lt;IP&gt;:80: connect: connection refused
</code></pre>
<p>Cert manager version: V1.1.0</p>
<pre><code>kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager.yaml
</code></pre>
<p>I also created an A record with IP address of ISTIO ingress on GKE for my domain on DNS server.</p>
<p>And here is the config I used:</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: istio-system
spec:
  acme:
    # Let's Encrypt uses this to contact you about expiring
    # certificates, and issues related to your account.
    email: &lt;email&gt;
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    - http01:
        ingress:
          class: nginx

---

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ingressgateway-certs
  namespace: istio-system
spec:
  secretName: ingressgateway-certs
  commonName: &lt;domain&gt;
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  dnsNames:
  - &lt;domain&gt;

---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: ingress-gateway
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: ingressgateway-certs
    hosts:
    - &lt;domain&gt;
</code></pre>
<p>Thanks</p>

Oscar
<p>Solved. The <code>ingress class</code> field in <code>ClusterIssuer</code> needs to be changed to <code>istio</code>.</p>
