<p>I am trying to deploy ingress-routes in Kubernetes following these guides:</p>
<ul>
<li><a href="https://cert-manager.io/docs/tutorials/acme/ingress/" rel="nofollow noreferrer">https://cert-manager.io/docs/tutorials/acme/ingress/</a></li>
<li><a href="https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip</a></li>
</ul>
<p>I have deployed a cluster-issuer:</p>
<pre class="lang-yml prettyprint-override"><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: &lt;Myemail&gt;
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
        ingress:
          class: nginx
          podTemplate:
            spec:
              nodeSelector:
                &quot;kubernetes.io/os&quot;: linux
</code></pre>
<p>Then I have deployed ingress:</p>
<pre class="lang-yml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: airflow-ingress
  namespace: airflow6
  annotations:
    kubernetes.io/ingress.class: nginx
    certmanager.k8s.io/cluster-issuer: letsencryp
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
  - hosts:
    - &lt;MYhost&gt;
    secretName: tls-secret1
  rules:
    - host: &lt;MYhost&gt;
      http:
        paths:
          - path: /
            backend:
              serviceName: airflow-web
              servicePort: 8080
</code></pre>
<p>Then if I try to get the certificate:</p>
<pre><code>kubectl describe certificate tls-secret1 --namespace airflow6

Error from server (NotFound): certificates.cert-manager.io &quot;tls-secret1&quot; not found
</code></pre>
<p>I have tried to deploy my own certificate:</p>
<pre class="lang-yml prettyprint-override"><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: tls-secret1
  namespace: airflow6
spec:
  secretName: tls-secret1
  dnsNames:
  - &lt;MYhost&gt;
  issuerRef:
    name: letsencrypt
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    group: cert-manager.io
</code></pre>
<p>Then run the same command:</p>
<pre class="lang-yml prettyprint-override"><code>kubectl describe certificate tls-secret1 --namespace airflow6


Name:         tls-secret1
Namespace:    airflow6
Labels:       &lt;none&gt;
Annotations:  API Version:  cert-manager.io/v1beta1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-10-12T10:50:25Z
  Generation:          1
  Resource Version:    9408916
  Self Link:           /apis/cert-manager.io/v1beta1/namespaces/airflow6/certificates/quickstart-example-tls
  UID:                 5c4f06e2-bb61-4eed-8999-58540d4055ce
Spec:
  Dns Names:
    &lt;Myhost&gt;
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt
  Secret Name:  tls-secret1
Status:
  Conditions:
    Last Transition Time:        2020-10-12T10:50:25Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
    Last Transition Time:        2020-10-12T10:50:25Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
  Next Private Key Secret Name:  tls-secret1
Events:
  Type    Reason     Age                       From          Message
  ----    ------     ----                      ----          -------
  Normal  Issuing    3m8s                      cert-manager  Issuing certificate as Secret does not exist
  Normal  Requested  3m8s                      cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-hl7vk&quot;
  Normal  Requested  &lt;invalid&gt;                 cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-vqmbh&quot;
  Normal  Generated  &lt;invalid&gt; (x3 over 3m8s)  cert-manager  Stored new private key in temporary Secret resource &quot;quickstart-example-tls-fgvn6&quot;
  Normal  Requested  &lt;invalid&gt;                 cert-manager  Created new CertificateRequest resource &quot;quickstart-example-tls-5gg9l&quot;
</code></pre>
<p>I don't know if I need to create a secret like this:</p>
<pre class="lang-yml prettyprint-override"><code> apiVersion: v1
  kind: Secret
    name: example-tls
    namespace: foo
  data:
    tls.crt: &lt;base64 encoded cert&gt;
    tls.key: &lt;base64 encoded key&gt;
  type: kubernetes.io/tls
</code></pre>
<p>But I really don't know what I have to put in <code>tls.crt</code> and <code>tls.key</code>.</p>
<p>In all the guides I have read I saw that when the ingress-routes is deployed automatically a certificate is created but for me is not working, what I am going wrong?</p>

J.C Guzman
<p>no you are not supposed to create the TLS secret on your own, it's like when you put the secret name in the ingress rule's tls section, then while doing the DNS verification, the secret will be created by issuer itself for the respective namespace in which the ingress rule has been created.</p>
<p>To cross-check on configs created or to create new one, you can refer <a href="https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html" rel="nofollow noreferrer">this</a></p>
<p>Then you can follow <a href="https://stackoverflow.com/questions/58423312/how-do-i-test-a-clusterissuer-solver/58436097?noredirect=1#comment103215785_58436097">this stack overflow post</a>, it will help you likely</p>
