title: Lets Encrypt using Certbot fails in kubernetes (works with cert-manager though)
body: <p>I have a Kubernetes cluster version 1.15.5 in Azure where I have installed <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">cert-manager</a> version v0.14.0</p>
  
  <p>It works fine with automatically issuing lets encrypt certificates against a valid DNS name: <strong>MY_DOMAIN</strong> pointing to the external IP address of the ingress controller.</p>
  
  <p>I would also like to be able to do this same thing using e.g. <a href="https://certbot.eff.org" rel="nofollow noreferrer">certbot</a>. I have tried to run certbot on my cluster with:</p>
  
  <pre><code>kubectl run --generator=run-pod/v1 certbot-shell --rm -i --tty --image certbot/certbot:amd64-latest -- -d MY_DOMAIN --manual --preferred-challenges http certonly
  </code></pre>
  
  <p>But it fails with:</p>
  
  <pre><code>Create a file containing just this data:
  
  QAPu****-klNq1RBgY
  
  And make it available on your web server at this URL:
  
  http://MY_DOMAIN/.well-known/acme-challenge/QAPu****-klNq1RBgY
  
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  
  Press Enter to Continue
  Waiting for verification...
  Challenge failed for domain MY_DOMAIN
  http-01 challenge for MY_DOMAIN
  Cleaning up challenges
  Some challenges have failed.
  
  IMPORTANT NOTES:
   - The following errors were reported by the server:
  
     Domain: MY_DOMAIN
     Type:   unauthorized
     Detail: Invalid response from
     http://MY_DOMAIN/.well-known/acme-challenge/QAPuDTHa****1qlLLOg
     [13.x.x.x]: 404
  
     To fix these errors, please make sure that your domain name was
     entered correctly and the DNS A/AAAA record(s) for that domain
  </code></pre>
  
  <p>So somehow <strong>cert-manager</strong> automatically takes care of creating the file during the challenge and making it available at:</p>
  
  <pre><code>http://MY_DOMAIN/.well-known/acme-challenge/QAPu****-klNq1RBgY
  </code></pre>
  
  <p>But I am not sure how I do that when using <strong>certbot</strong> or if there some other way to do this??</p>
  
  <p>Based on below suggestions I have tried to install Kube lego (0.1.2) instead (for legacy 1.8 cluster) but seems to fail with:</p>
  
  <pre><code>level=error msg="Error while processing certificate requests: 403 urn:acme:error:unauthorized: Account creation on ACMEv1 is disabled. Please upgrade your ACME client to a version that supports ACMEv2 / RFC 8555. See https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430 for details." context=kubelego 
  </code></pre>
  
  <p>So I have tried to upgrade to:</p>
  
  <p><a href="https://acme-staging-v02.api.letsencrypt.org/directory" rel="nofollow noreferrer">https://acme-staging-v02.api.letsencrypt.org/directory</a></p>
  
  <p>but then I get:</p>
  
  <pre><code>level=error msg="Error while processing certificate requests: Head : unsupported protocol scheme \"\"" context=kubelego
  </code></pre>
  
  <p>I found:</p>
  
  <p><a href="https://github.com/jetstack/kube-lego/issues/301" rel="nofollow noreferrer">https://github.com/jetstack/kube-lego/issues/301</a></p>
  
  <p>So looks like kube-lego cannot be used with ACME version 2 :-(</p>