<p>I'm trying to setup cert-manager v0.13.0 on my minikube cluster. I've followed <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">their tutorial</a>, but it seems the cert-manager pod keeps timing out, trying to get to the LetsEncrypt API servers:</p>
<pre><code>$ kubectl apply --validate=false -f https://raw.githubusercontent.com/jetstack/cert-manager/v0.13.0/deploy/manifests/00-crds.yaml
$ kubectl create namespace cert-manager
$ helm repo add jetstack https://charts.jetstack.io
$ helm repo update
$ helm install cert-manager --namespace cert-manager --version v0.13.0 jetstack/cert-manager
</code></pre>
<p>Here's my acme yaml:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: xx@yyy.com
    privateKeySecretRef:
      name: my-issuer-account-key
    solvers:
      - dns01:
          cloudflare:
            email: xx@yyy.com
            apiKeySecretRef:
              name: cloudflare-api-token-secret
              key: api-token    
</code></pre>
<p>The cert-manager pod logs show the timeout:</p>
<pre><code>I0209 20:43:34.382250       1 logger.go:90] Calling GetAccount
E0209 20:43:39.384093       1 setup.go:208] cert-manager/controller/clusterissuers &quot;msg&quot;=&quot;failed to verify ACME account&quot; &quot;error&quot;=&quot;Get https://acme-staging-v02.api.letsencrypt.com/directory: dial tcp 192.64.119.254:443: i/o timeout&quot; &quot;related_resource_kind&quot;=&quot;Secret&quot; &quot;related_resource_name&quot;=&quot;my-issuer-account-key&quot; &quot;related_resource_namespace&quot;=&quot;cert-manager&quot; &quot;resource_kind&quot;=&quot;ClusterIssuer&quot; &quot;resource_name&quot;=&quot;letsencrypt&quot; &quot;resource_namespace&quot;=&quot;&quot; 
E0209 20:43:39.385555       1 sync.go:81] cert-manager/controller/clusterissuers &quot;msg&quot;=&quot;error setting up issuer&quot; &quot;error&quot;=&quot;Get https://acme-staging-v02.api.letsencrypt.com/directory: dial tcp 192.64.119.254:443: i/o timeout&quot; &quot;resource_kind&quot;=&quot;ClusterIssuer&quot; &quot;resource_name&quot;=&quot;letsencrypt&quot; &quot;resource_namespace&quot;=&quot;&quot; 
E0209 20:43:39.389659       1 controller.go:131] cert-manager/controller/clusterissuers &quot;msg&quot;=&quot;re-queuing item  due to error processing&quot; &quot;error&quot;=&quot;Get https://acme-staging-v02.api.letsencrypt.com/directory: dial tcp 192.64.119.254:443: i/o timeout&quot; &quot;key&quot;=&quot;letsencrypt&quot; 
</code></pre>
<p>So I setup a bash pod to check the API's reachability, and there seems to be no problem:</p>
<pre><code>$ kubectl run my-shell -n cert-manager --rm -i --tty --image ubuntu -- bash
$ apt-get update -y
$ apt-get install -y curl
$ https://acme-staging-v02.api.letsencrypt.org/directory

{
&quot;xxxxxxxxx&quot;: &quot;https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417&quot;,
&quot;keyChange&quot;: &quot;https://acme-staging-v02.api.letsencrypt.org/acme/key-change&quot;,
&quot;meta&quot;: {
    &quot;caaIdentities&quot;: [
    &quot;letsencrypt.org&quot;
    ],
    &quot;termsOfService&quot;: &quot;https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf&quot;,
    &quot;website&quot;: &quot;https://letsencrypt.org/docs/staging-environment/&quot;
},
&quot;newAccount&quot;: &quot;https://acme-staging-v02.api.letsencrypt.org/acme/new-acct&quot;,
&quot;newNonce&quot;: &quot;https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce&quot;,
&quot;newOrder&quot;: &quot;https://acme-staging-v02.api.letsencrypt.org/acme/new-order&quot;,
&quot;revokeCert&quot;: &quot;https://acme-staging-v02.api.letsencrypt.org/acme/revoke-cert&quot;
}
</code></pre>
<p>Update: as requested, here's the /etc/resolve.conf file from the bash pod:</p>
<pre><code>nameserver 10.96.0.10
search cert-manager.svc.cluster.local svc.cluster.local cluster.local
options ndots:5
</code></pre>
<p>But I don't know how to get the same file from the cert-manager pod, as it doesn't let me open /bin/sh or /bin/bash.</p>
<p>I have no idea why the timeout occurs. Any thoughts?</p>

Sagi Mann
<p>You mentioned acme server to <code>acme-staging-v02.api.letsencrypt.org/directory</code>, but it seems request is done to <code>acme-staging-v02.api.letsencrypt.com/directory</code>. There is a diff <code>.com</code> vs <code>.org</code>. Please check your <code>clusterissuer</code> yaml with the command:</p>

<pre><code>kubectl get clusterissuer letsencrypt -o yaml
</code></pre>

<p>If you added wrong url on the yaml, you can always delete that clusterissuer, and create again.</p>
