<p>In the <a href="https://istio.io/docs/examples/advanced-gateways/ingress-certmgr/" rel="noreferrer">document</a> there is an example about <strong>Securing Kubernetes Ingress with Cert-Manager</strong> which is not using Gateway + VirtualService. </p>

<p>I have tried to make it work with acme http01 but the certificate can not be issued as in log challenge I have 404 error. Seems it can not access to domain checking challenges. Is there any best practice with the specifications that I mentioned? </p>

<p>[Update 1]</p>

<p>I want to use <a href="https://istio.io/blog/2019/custom-ingress-gateway/" rel="noreferrer">istio gateway</a> with <code>SDS</code> option for <code>TLS</code> and secure that by using <a href="https://docs.cert-manager.io/en/latest/tasks/issuers/setup-acme/http01/index.html#" rel="noreferrer">cert-manager with http-01</a>.</p>

<p>According to the documentation I found some example like <a href="https://istio.io/docs/examples/advanced-gateways/ingress-certmgr/" rel="noreferrer">Securing Kubernetes Ingress with Cert-Manager</a> or <a href="https://istio.io/blog/2019/custom-ingress-gateway/" rel="noreferrer">Deploy a Custom Ingress Gateway Using Cert-Manager</a>. However these examples are using Kuberenetes Ingress resource itself (Not istio gateway) or like the second example is using <code>dns-01</code>. </p>

<p>I need an instruction which including <a href="https://istio.io/blog/2019/custom-ingress-gateway/" rel="noreferrer">istio gateway</a> with <code>SDS</code> option for <code>TLS</code> and secure that by using <a href="https://docs.cert-manager.io/en/latest/tasks/issuers/setup-acme/http01/index.html#" rel="noreferrer">cert-manager with http-01</a>. Istio gateway give me ability to use <code>VirtualService</code>.</p>

<p>Thanks!</p>

Amir Movahedi
<p>I have found the answer but not really sure why this way. I have followed <a href="https://istio.io/docs/examples/advanced-gateways/ingress-certmgr/" rel="nofollow noreferrer">documentation</a> with some changes. </p>

<p>First I edited the <code>istio-autogenerated-k8s-ingress</code> using <code>kubectl -n istio-system edit gateway</code> command. 
I removed whole the <code>HTTPS</code> part and I left <code>HTTP</code> part there. </p>

<p>Then I created another <code>Gateway</code> something like :</p>

<pre class="lang-sh prettyprint-override"><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - 'example.com'
    port:
      name: http
      number: 80
      protocol: HTTP2
    tls:
      httpsRedirect: true
  - hosts:
    - 'example.com'
    port:
      name: https-default
      number: 443
      protocol: HTTPS
    tls:
      credentialName: ingress-cert-staging
      mode: SIMPLE
      privateKey: sds
      serverCertificate: sds
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "example.com"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080

EOF


</code></pre>

<p>With this cert-manager issued my certificate ( I guess by <code>istio-autogenerated-k8s-ingress</code> Gateway!! no idea!!) and I can create multiple Gateway and Virtual Service like example above. So everything work well!! This is just my idea and doing blindly is not a right way. Please if you have better answer and you know why the stuff happening like the way I explained let me know.</p>

<p>Thanks!</p>
