<p>I have a Kubernetes cluster version 1.15.5 in Azure where I have installed <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">cert-manager</a> version v0.14.0</p>

<p>It works fine with automatically issuing lets encrypt certificates against a valid DNS name: <strong>MY_DOMAIN</strong> pointing to the external IP address of the ingress controller.</p>

<p>I would also like to be able to do this same thing using e.g. <a href="https://certbot.eff.org" rel="nofollow noreferrer">certbot</a>. I have tried to run certbot on my cluster with:</p>

<pre><code>kubectl run --generator=run-pod/v1 certbot-shell --rm -i --tty --image certbot/certbot:amd64-latest -- -d MY_DOMAIN --manual --preferred-challenges http certonly
</code></pre>

<p>But it fails with:</p>

<pre><code>Create a file containing just this data:

QAPu****-klNq1RBgY

And make it available on your web server at this URL:

http://MY_DOMAIN/.well-known/acme-challenge/QAPu****-klNq1RBgY

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Press Enter to Continue
Waiting for verification...
Challenge failed for domain MY_DOMAIN
http-01 challenge for MY_DOMAIN
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: MY_DOMAIN
   Type:   unauthorized
   Detail: Invalid response from
   http://MY_DOMAIN/.well-known/acme-challenge/QAPuDTHa****1qlLLOg
   [13.x.x.x]: 404

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
</code></pre>

<p>So somehow <strong>cert-manager</strong> automatically takes care of creating the file during the challenge and making it available at:</p>

<pre><code>http://MY_DOMAIN/.well-known/acme-challenge/QAPu****-klNq1RBgY
</code></pre>

<p>But I am not sure how I do that when using <strong>certbot</strong> or if there some other way to do this??</p>

<p>Based on below suggestions I have tried to install Kube lego (0.1.2) instead (for legacy 1.8 cluster) but seems to fail with:</p>

<pre><code>level=error msg="Error while processing certificate requests: 403 urn:acme:error:unauthorized: Account creation on ACMEv1 is disabled. Please upgrade your ACME client to a version that supports ACMEv2 / RFC 8555. See https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430 for details." context=kubelego 
</code></pre>

<p>So I have tried to upgrade to:</p>

<p><a href="https://acme-staging-v02.api.letsencrypt.org/directory" rel="nofollow noreferrer">https://acme-staging-v02.api.letsencrypt.org/directory</a></p>

<p>but then I get:</p>

<pre><code>level=error msg="Error while processing certificate requests: Head : unsupported protocol scheme \"\"" context=kubelego
</code></pre>

<p>I found:</p>

<p><a href="https://github.com/jetstack/kube-lego/issues/301" rel="nofollow noreferrer">https://github.com/jetstack/kube-lego/issues/301</a></p>

<p>So looks like kube-lego cannot be used with ACME version 2 :-(</p>

u123
<p>Short version of the comments: certbot in DNS mode will probably work, HTTP01 will not since you would need to dynamically adjust Ingress settings, which is exactly what cert-manager does. Overall this is a great example of why running a version of Kube from 2.5 years ago is not good.</p>
