<p>So, I have a Kubernetes cluster running on aws-eks, it's only a test cluster to learn and build a production cluster at the moment.
I've already managed to make everything I need to work except for the SSL certificate! :(</p>
<p>I'm using cert-manager to add a SSL certificate on my domain &quot;brunolira.dev&quot;, which I bought on google domains and used AWS' Route53 to redirect to my kubernetes load balancer but did not have any success yet.</p>
<p>By using the staging cert-manager (<a href="https://acme-staging-v02.api.letsencrypt.org/directory" rel="nofollow noreferrer">https://acme-staging-v02.api.letsencrypt.org/directory</a>) i get the following certificate on firefox:
<a href="https://i.stack.imgur.com/kcN2n.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kcN2n.png" alt="enter image description here" /></a></p>
<p>When I use the prod cert-manager url (<a href="https://acme-prod-v02.api.letsencrypt.org/directory" rel="nofollow noreferrer">https://acme-prod-v02.api.letsencrypt.org/directory</a>) it changes to this:
<a href="https://i.stack.imgur.com/OPJ5q.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OPJ5q.png" alt="enter image description here" /></a>
I don't understand why is it saying &quot;Kubernetes Ingress Controller <strong>Fake</strong> Certificate&quot; nor why
the DNS changes to &quot;ingress.local&quot;</p>
<p>This is my ClusterIssuer:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: MYEMAIL(WHICH I DID NOT REGISTER ANYWHERE, IS THERE SUCH A THING?)
    privateKeySecretRef:
      name: cluster-issuer-account-key
    server: https://acme-prod-v02.api.letsencrypt.org/directory
    solvers:
    - selector:
        dnsZones:
          - &quot;brunolira.dev&quot;
      dns01:
        route53:
          region: us-east-2
          hostedZoneID: HOSTEDZONE ID ON ROUTE 53
          role: arn:aws:iam::IAMUSERID:role/dns-manager
</code></pre>
<p>This is my ingress:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
spec:
  tls:
  - hosts:
    - brunolira.dev
    secretName: echo-tls
  rules:
  - host: brunolira.dev
    http:
      paths:
      - path: /common
        backend:
          serviceName: common-service
          servicePort: 80
      - path: /offline
        backend:
          serviceName: offline-service
          servicePort: 80
</code></pre>
<p>Any help, guidance, suggestion or tip on how could I solve this will be very much appreciated!</p>
<p>In case you want to take a look at the prod generated certificate you can access the page <a href="http://brunolira.dev" rel="nofollow noreferrer">brunolira.dev</a> and verify whatever you need!
I can also provide any information about my configuration that would be useful on find a solution to to this problem!</p>

Bruno Lira
<p>SOLVED!
Long story short, I was using the wrong letsencrypt production URL :)</p>
<p>Even though on the provided clusterIssuer I was using &quot;dns01&quot; solver I was trying with &quot;http01&quot; too.</p>
<p>This was my final ClusterIssuer:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt-prod
 namespace: cert-manager
spec:
 acme:
   server: https://acme-v02.api.letsencrypt.org/directory
   email: MYEMAIL
   privateKeySecretRef:
     name: letsencrypt-prod
   solvers:
   - http01:
       ingress:
         class:  nginx
</code></pre>
<p>And this was my final Ingress:</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    cert-manager.io/acme-challenge-type: &quot;http01&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-staging&quot;
spec:
  tls:
  - hosts:
    - brunolira.dev
    secretName: echo-tls
  rules:
  - host: brunolira.dev
    http:
      paths:
      - path: /serviceA
        backend:
          serviceName: serviceA
          servicePort: 80
      - path: /ServiceB
        backend:
          serviceName: serviceB
          servicePort: 80
</code></pre>
<p>This <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes-pt" rel="nofollow noreferrer">link</a> helped me see what I was doing wrong! Pretty good tutorial :)</p>
