title: SSL Certificates on Kubernetes Using ACME
body: <p>I have been following this tutorial: <a href="https://cert-manager.io/docs/" rel="nofollow noreferrer">https://cert-manager.io/docs/</a> , and after I have installed my cert manager and made sure they are running with kubectl get pods --namespace cert-manager,</p>
  <pre><code>cert-manager-5597cff495-l5hjs             1/1     Running   0          91m
  cert-manager-cainjector-bd5f9c764-xrb2t   1/1     Running   0          91m
  cert-manager-webhook-5f57f59fbc-q5rqs     1/1     Running   0          91m
  </code></pre>
  <p>I then configured my cert-manager using ACME issuer by following this tutorial <a href="https://cert-manager.io/docs/configuration/acme/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/acme/</a> .</p>
  <pre><code>apiVersion: cert-manager.io/v1
  kind: ClusterIssuer
  metadata:
    name: letsencrypt-staging
  spec:
    acme:
      # You must replace this email address with your own.
      # Let's Encrypt will use this to contact you about expiring
      # certificates, and issues related to your account.
      email: aidenhsy@gmail.com
      server: https://acme-staging-v02.api.letsencrypt.org/directory
      privateKeySecretRef:
        # Secret resource that will be used to store the account's private key.
        name: letsencrypt-staging
      # Add a single challenge solver, HTTP01 using nginx
      solvers:
        - http01:
            ingress:
              class: nginx
  </code></pre>
  <p>Here is my full ingress config file:</p>
  <pre><code>apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: ingress-srv
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: 'true'
  spec:
    rules:
      - host: www.hyhaus.xyz
        http:
          paths:
            - path: /api/?(.*)
              backend:
                serviceName: devback-srv
                servicePort: 4000
            - path: /?(.*)
              backend:
                serviceName: devfront-srv
                servicePort: 3000
  ---
  apiVersion: v1
  kind: Service
  metadata:
    annotations:
      service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: 'true'
      service.beta.kubernetes.io/do-loadbalancer-hostname: 'www.hyhaus.xyz'
    labels:
      helm.sh/chart: ingress-nginx-2.0.3
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/version: 0.32.0
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/component: controller
    name: ingress-nginx-controller
    namespace: ingress-nginx
  spec:
    type: LoadBalancer
    externalTrafficPolicy: Local
    ports:
      - name: http
        port: 80
        protocol: TCP
        targetPort: http
      - name: https
        port: 443
        protocol: TCP
        targetPort: https
    selector:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/component: controller
  
  ---
  apiVersion: cert-manager.io/v1
  kind: ClusterIssuer
  metadata:
    name: letsencrypt-staging
  spec:
    acme:
      # You must replace this email address with your own.
      # Let's Encrypt will use this to contact you about expiring
      # certificates, and issues related to your account.
      email: aidenhsy@gmail.com
      server: https://acme-staging-v02.api.letsencrypt.org/directory
      privateKeySecretRef:
        # Secret resource that will be used to store the account's private key.
        name: letsencrypt-staging
      # Add a single challenge solver, HTTP01 using nginx
      solvers:
        - http01:
            ingress:
              class: nginx
  </code></pre>
  <p>However when I browse to my site, the browser warns: security certificate is not trusted by your computer's operating system. And when I took a look a my certificate, it shows self-assigned, which is not really what I want. <a href="https://i.stack.imgur.com/VqbYX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VqbYX.png" alt="certificate" /></a> Am I doing something wrong here?</p>