<p>We're using kubernetes with ingresses, cert-manager (v1.9.1) and the letsencrypt issuer.
Our use case is the following:
We have a multitenant solution with 3 services that allows people to change their domain names (1 for each service).
Each time someone is changing a domain name, it triggers the update of the ingress related to the service. This update triggers the generation of a new order by the cert manager.</p>
<p>We meet 2 issues:</p>
<ul>
<li>When someone is changing one domain name (making it replaced in the spec.tls[] and spec.rules[] sections of the ingress), the order created seems to regenerate all the letsencrypt certificates from the ingress and not only the one changed (which leads to the letsencrypt issue &quot;too many certificates already issued&quot; after some tries).</li>
<li>When one of the certificates of an order has an error (due to the previous issue, &quot;too many certificates already issued&quot;), the other certificates in the order (that do normally not have any problem) seem not to be generated either.</li>
</ul>
<p>What would be the best strategy to avoid these issues with our use case? (Maybe we would have to create one ingress by domain name? Or is there a way to have one order by certificate and not to trigger the regeneration of existing certificates on the update of an ingress?)</p>
<p>--- EDITED ---</p>
<p>Here is the ingress (with {hidden} fields and renaming for privacy):</p>
<pre class="lang-yaml prettyprint-override"><code>kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: server-ingress
  namespace: {hidden}
  annotations:
    cert-manager.io/issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - test1.customer-domain.fr
        - test1.our-company.com
        - test2.our-company.com
      secretName: our-company-server-tls
  rules:
    - host: test1.customer-domain.fr
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              serviceName: server-v3-24-5
              servicePort: 8080
    - host: test1.our-company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              serviceName: server-v3-24-5
              servicePort: 8080
    - host: test2.our-company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              serviceName: server-v3-24-5
              servicePort: 8080
status:
  loadBalancer:
    ingress:
      - ip: {hidden}
</code></pre>
<p>Thank you,</p>

Corentin
<blockquote>
<p>The order created seems to regenerate all the letsencrypt certificates from the ingress and not only the one changed</p>
</blockquote>
<p>Based on the discussion, This is because you are using the same secret name for all the ingress, you need to have a different secret name for each host in TLS in the ingress and this way it will not recreate all certs order.</p>
<p>So this should work,</p>
<pre><code>  tls:
    - secretName: test1.customer-domain.fr
      hosts:
        - test1.customer-domain.fr
    - secretName: test1.our-company.com
      hosts:
        - test1.our-company.com
  rules:
    - host: test1.customer-domain.fr
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              serviceName: server-v3-24-5
              servicePort: 8080
    - host: test1.our-company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              serviceName: server-v3-24-5
              servicePort: 8080
</code></pre>
