Reputation: 818
I'm trying to configure the certificate for my application, but I'm not able to do that. and the last error that I see is in the Challenge I followed https://cert-manager.io/docs/faq/troubleshooting
Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
The server is a baremetal one.
k describe certificate letsencrypt-something-cert
Name: letsencrypt-something-cert
Namespace: default
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1
Kind: Certificate
Metadata:
Creation Timestamp: 2021-11-29T11:04:21Z
Generation: 1
Managed Fields:
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:ownerReferences:
.:
k:{"uid":"2ae6b0b5-46ca-4a56-ab77-3d2fbe2add90"}:
f:spec:
.:
f:dnsNames:
f:issuerRef:
.:
f:group:
f:kind:
f:name:
f:secretName:
f:usages:
Manager: controller
Operation: Update
Time: 2021-11-29T11:04:21Z
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:status:
.:
f:conditions:
f:nextPrivateKeySecretName:
Manager: controller
Operation: Update
Subresource: status
Time: 2021-11-29T11:04:21Z
Owner References:
API Version: networking.k8s.io/v1
Block Owner Deletion: true
Controller: true
Kind: Ingress
Name: api-ingress
UID: 2ae6b0b5-46ca-4a56-ab77-3d2fbe2add90
Resource Version: 7041188
UID: a59dedcc-1efe-4778-8ba4-e6a7eee28849
Spec:
Dns Names:
something-doe.com
Issuer Ref:
Group: cert-manager.io
Kind: ClusterIssuer
Name: letsencrypt-staging
Secret Name: letsencrypt-something-cert
Usages:
digital signature
key encipherment
Status:
Conditions:
Last Transition Time: 2021-11-29T11:04:21Z
Message: Issuing certificate as Secret does not exist
Observed Generation: 1
Reason: DoesNotExist
Status: False
Type: Ready
Last Transition Time: 2021-11-29T11:04:21Z
Message: Issuing certificate as Secret does not exist
Observed Generation: 1
Reason: DoesNotExist
Status: True
Type: Issuing
Next Private Key Secret Name: letsencrypt-something-cert-nblzz
Events: <none>
k describe ClusterIssuer letsencrypt-staging
Name: letsencrypt-staging
Namespace:
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1
Kind: ClusterIssuer
Metadata:
Creation Timestamp: 2021-11-29T11:21:59Z
Generation: 1
Managed Fields:
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.:
f:kubectl.kubernetes.io/last-applied-configuration:
f:spec:
.:
f:acme:
.:
f:email:
f:privateKeySecretRef:
.:
f:name:
f:server:
f:solvers:
Manager: kubectl-client-side-apply
Operation: Update
Time: 2021-11-29T11:21:59Z
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:status:
.:
f:acme:
.:
f:lastRegisteredEmail:
f:uri:
f:conditions:
Manager: controller
Operation: Update
Subresource: status
Time: 2021-11-29T11:22:00Z
Resource Version: 7036745
UID: 142f6b6d-b840-4b2e-b50f-278091161b31
Spec:
Acme:
Email: [email protected]
Preferred Chain:
Private Key Secret Ref:
Name: letsencrypt-something-cert
Server: https://acme-staging-v02.api.letsencrypt.org/directory
Solvers:
http01:
Ingress:
Class: nginx
Status:
Acme:
Last Registered Email: [email protected]
Uri: https://acme-staging-v02.api.letsencrypt.org/acme/acct/31803711
Conditions:
Last Transition Time: 2021-11-29T11:22:00Z
Message: The ACME account was registered with the ACME server
Observed Generation: 1
Reason: ACMEAccountRegistered
Status: True
Type: Ready
Events: <none>
k describe certificaterequests.cert-manager.io
Name: letsencrypt-something-cert-fkzs5
Namespace: default
Labels: <none>
Annotations: cert-manager.io/certificate-name: letsencrypt-something-cert
cert-manager.io/certificate-revision: 1
cert-manager.io/private-key-secret-name: letsencrypt-something-cert-nblzz
API Version: cert-manager.io/v1
Kind: CertificateRequest
Metadata:
Creation Timestamp: 2021-11-29T11:04:21Z
Generate Name: letsencrypt-something-cert-
Generation: 1
Managed Fields:
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.:
f:cert-manager.io/certificate-name:
f:cert-manager.io/certificate-revision:
f:cert-manager.io/private-key-secret-name:
f:generateName:
f:ownerReferences:
.:
k:{"uid":"a59dedcc-1efe-4778-8ba4-e6a7eee28849"}:
f:spec:
.:
f:issuerRef:
.:
f:group:
f:kind:
f:name:
f:request:
f:usages:
Manager: controller
Operation: Update
Time: 2021-11-29T11:04:21Z
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:status:
.:
f:conditions:
Manager: controller
Operation: Update
Subresource: status
Time: 2021-11-29T11:04:21Z
Owner References:
API Version: cert-manager.io/v1
Block Owner Deletion: true
Controller: true
Kind: Certificate
Name: letsencrypt-something-cert
UID: a59dedcc-1efe-4778-8ba4-e6a7eee28849
Resource Version: 7041199
UID: d885cbc4-babb-457c-bec5-350cbcea5f19
Spec:
Extra:
authentication.kubernetes.io/pod-name:
cert-manager-6c576bddcf-2qkcp
authentication.kubernetes.io/pod-uid:
b1a464a5-6e05-4d89-b95f-fae9f5c4cb35
Groups:
system:serviceaccounts
system:serviceaccounts:cert-manager
system:authenticated
Issuer Ref:
Group: cert-manager.io
Kind: ClusterIssuer
Name: letsencrypt-staging
Request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ213213V2tDQVFBd0FEQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU0wSApaOFpvMWRvQlhXMjJ3eUVtWHhnZXpTQzNCaGFMSzdyOHlSRlR4U2RMWXNzeGk4Z1lia2xJTXJZZE9qV01Ca0lICkpDMDQxelpLZ2RscTN5RWxjL3ZqcVIwdHByRk5oc3lQZWpBOVZHdVVCeFdybGRRZDkyK0dEOFowN3l5QzYwSnAKMlRXTTlFc2ZpVHdmUW1QcDN3TFptZ09TTXVIOU9JajlQYnB6ak9YK1NITXRIYlgwTFkyQ2V2NVlMdVJ1Z3dKUwo2TUgrWnF4VHRwTW9123123KzdUMTBGNDdXdis1S3FPVjl1Vjg2cytDSlF5cXY0QnRWM3lIVGEwb3hDNUYvM1lCcThXCjdrZ3Bxc3d3RTBhR0V3Wnlqbm5rQ3ZpUUg1cFlWM0N3QmNXRThXditpVDRmWXYvVmo5MTlrM0123123pIYzdNenhxSEYKNWd4Q2x0R3AxK1NXOFc2akhSRUNBd0VBQWFBOE1Eb0dDU3FHU0liM0RRRUpEakV0TUNzd0hBWURWUjBSQkJVdwpMFpYSXRabWx1WVc1alpTNWpiMjB3Q3dZRFZSMFBCQVFEQWdXZ01BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUJIUmFndnhUWWJjLzRJOGJyTVN4MHNUY05MVmFGYzRydkpMY01saFZJbkRrVEl1K2FrTmtYUENNZUMKMDdZUXhZclE1UlZBV1lERGlxYzU4V0x0QXR6TnNieG9JVGVtdENPVFFEU3NXZFh6T3hIckc1aUpEVnEyNW96VQo4WEZWNEFZOFB0VitkUnIyK21LYnh0aUkrMCtIcWxCdFJ1SExYUStvYnpJQ2pVQmw5TWhER2RGdHpzM25ncnEwCjhpeG4xanFFNHlhZTBsRlhtRHFXYU1DODQ4Nm94N1dEZk9Qa2xWNFZhQUJablBEWlREb3FVOFpzUXJPVXZmSm4KOFRKc3Zpd1JNeDZOMjJSN2J0VFRlREhKVjdnbXhmdnB0bFdncEZHc0F5MCtUUDk5YjZBMlVsWUxqbDVXVW45NgpxYTBRTU1aVlVtek14YTYzUGJhdEt5aXhMNHM3Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
UID: 0bac5f49-060b-4c53-baa9-cca209acebbe
Usages:
digital signature
key encipherment
Username: system:serviceaccount:cert-manager:cert-manager
Status:
Conditions:
Last Transition Time: 2021-11-29T11:04:21Z
Message: Certificate request has been approved by cert-manager.io
Reason: cert-manager.io
Status: True
Type: Approved
Last Transition Time: 2021-11-29T11:04:21Z
Message: Waiting on certificate issuance from order default/letsencrypt-something-cert-fkzs5-1375084254: "pending"
Reason: Pending
Status: False
Type: Ready
Events: <none>
k get clusterissuers.cert-manager.io
NAME READY AGE
letsencrypt-staging True 26h
k describe clusterissuers.cert-manager.io
Name: letsencrypt-staging
Namespace:
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1
Kind: ClusterIssuer
Metadata:
Creation Timestamp: 2021-11-29T11:21:59Z
Generation: 1
Managed Fields:
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.:
f:kubectl.kubernetes.io/last-applied-configuration:
f:spec:
.:
f:acme:
.:
f:email:
f:privateKeySecretRef:
.:
f:name:
f:server:
f:solvers:
Manager: kubectl-client-side-apply
Operation: Update
Time: 2021-11-29T11:21:59Z
API Version: cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:status:
.:
f:acme:
.:
f:lastRegisteredEmail:
f:uri:
f:conditions:
Manager: controller
Operation: Update
Subresource: status
Time: 2021-11-29T11:22:00Z
Resource Version: 7036745
UID: 142f6b6d-b840-4b2e-b50f-278091161b31
Spec:
Acme:
Email: [email protected]
Preferred Chain:
Private Key Secret Ref:
Name: letsencrypt-something-cert
Server: https://acme-staging-v02.api.letsencrypt.org/directory
Solvers:
http01:
Ingress:
Class: nginx
Status:
Acme:
Last Registered Email: [email protected]
Uri: https://acme-staging-v02.api.letsencrypt.org/acme/acct/31803711
Conditions:
Last Transition Time: 2021-11-29T11:22:00Z
Message: The ACME account was registered with the ACME server
Observed Generation: 1
Reason: ACMEAccountRegistered
Status: True
Type: Ready
Events: <none>
k describe orders.acme.cert-manager.io
Name: letsencrypt-something-cert-fkzs5-1375084254
Namespace: default
Labels: <none>
Annotations: cert-manager.io/certificate-name: letsencrypt-something-cert
cert-manager.io/certificate-revision: 1
cert-manager.io/private-key-secret-name: letsencrypt-something-cert-nblzz
API Version: acme.cert-manager.io/v1
Kind: Order
Metadata:
Creation Timestamp: 2021-11-29T11:04:21Z
Generation: 1
Managed Fields:
API Version: acme.cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.:
f:cert-manager.io/certificate-name:
f:cert-manager.io/certificate-revision:
f:cert-manager.io/private-key-secret-name:
f:ownerReferences:
.:
k:{"uid":"d885cbc4-babb-457c-bec5-350cbcea5f19"}:
f:spec:
.:
f:dnsNames:
f:issuerRef:
.:
f:group:
f:kind:
f:name:
f:request:
Manager: controller
Operation: Update
Time: 2021-11-29T11:04:21Z
API Version: acme.cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:status:
.:
f:authorizations:
f:finalizeURL:
f:state:
f:url:
Manager: controller
Operation: Update
Subresource: status
Time: 2021-11-29T11:04:22Z
Owner References:
API Version: cert-manager.io/v1
Block Owner Deletion: true
Controller: true
Kind: CertificateRequest
Name: letsencrypt-something-cert-fkzs5
UID: d885cbc4-babb-457c-bec5-350cbcea5f19
Resource Version: 7041110
UID: 1bbe18b7-9275-4dc4-872d-bc5f5abf497c
Spec:
Dns Names:
something-doe.com
Issuer Ref:
Group: cert-manager.io
Kind: ClusterIssuer
Name: letsencrypt-staging
Request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2dUQ0NBV1232342342tDQVFBd0FEQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU0wSApaOFpvMWRvQlhXMjJ3eUVtWHhnZXpTQzNCaGFMSzdyOHlSRlR4U2RMWXNzeGk4Z1lia2xJTXJZZE9qV01Ca0lICkpDMDQxelpLZ2RscTN5RWxjL3ZqcVIwdHByRk5oc3lQZWpBOVZHdVVCeFdybGRRZDkyK0dEOFowN3l5QzYwSnAKMlRXTTlFc2ZpVHdmUW1QcDN3TFptZ09TTXVIOU9JajlQYnB6ak9YK1NITXRIYlgwNVlMdVJ1Z3dKUwo2TUgrWnF4VHRwTW9kKzdU432423TBGNDdXdis1S3FPVjl1Vjg2cytDSlF5cXY0QnRWM3lIVGEwb3hDNUYvM1lCcThXCjdrZ3Bxc3d3RTBhR0V3Wnlqbm5rQ3ZpUUg1cFlWM0N3QmNXRThXditp234342VDRmWXYvVmo5MTlrM0pIYzdNenhxSEYKNWd4Q2x0R3AxK1NXOFc2akhSRUNBd0VBQWFBOE1Eb0dDU3FHU0liM0RRRUpEakV0TUNzd0hBWURWUjBSQkJVdwpFNElSYjNSMFpYSXRabWx1WV3Q3dZRFZSMFBCQVFEQWdXZ01BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUJIUmFndnhUWWJjLzRJOGJyTVN4MHNUY05MVmFGYzRydkpMY01saFZJbkRrVEl1K2FrTmtYUENNZUMKMDdZUXhZclE1UlZBV1lERGlxYzU4V0x0QXR6TnNieG9JVGVtdENPVFFEU3NXZFh6T3hIckc1aUpEVnEyNW96VQo4WEZWNEFZOFB0VitkUnIyK21LYnh0aUkrMCtIcWxCdFJ1SExYUStvYnpJQ2pVQmw5TWhER2RGdHpzM25ncnEwCjhpeG4xanFFNHlhsdfZTBsRlhtRHFXYU1DODQ4Nm94N1dEZk9Qa2xWNFZhQUJablBEWlREb3FVOFpzUXJPVXZmSm4KOFRKc3Zpd1JNeDZOMjJSN2J0VFRlREhKVjdnbXhmdnB0bFdncEZHc0F5MCtUUDk5YjZBMlVsWUxqbDVXVW45NgpxYTBRTU1aVlVtek14YTYzUGJhdEt5aXhMNHM3Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
Status:
Authorizations:
Challenges:
Token: 382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8
Type: http-01
URL: https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/811518411/rvlRdw
Token: 382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8
Type: dns-01
URL: https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/811518411/nLQlIQ
Token: 382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8
Type: tls-alpn-01
URL: https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/811518411/nccdbA
Identifier: something-doe.com
Initial State: pending
URL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/811518411
Wildcard: false
Finalize URL: https://acme-staging-v02.api.letsencrypt.org/acme/finalize/31803711/881473868
State: pending
URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/31803711/881473868
Events: <none>
k describe challenges.acme.cert-manager.io
Name: letsencrypt-something-cert-fkzs5-1375084254-3013399563
Namespace: default
Labels: <none>
Annotations: <none>
API Version: acme.cert-manager.io/v1
Kind: Challenge
Metadata:
Creation Timestamp: 2021-11-29T11:04:22Z
Finalizers:
finalizer.acme.cert-manager.io
Generation: 1
Managed Fields:
API Version: acme.cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:metadata:
f:finalizers:
.:
v:"finalizer.acme.cert-manager.io":
f:ownerReferences:
.:
k:{"uid":"1bbe18b7-9275-4dc4-872d-bc5f5abf497c"}:
f:spec:
.:
f:authorizationURL:
f:dnsName:
f:issuerRef:
.:
f:group:
f:kind:
f:name:
f:key:
f:solver:
.:
f:http01:
.:
f:ingress:
.:
f:class:
f:token:
f:type:
f:url:
f:wildcard:
Manager: controller
Operation: Update
Time: 2021-11-29T11:04:22Z
API Version: acme.cert-manager.io/v1
Fields Type: FieldsV1
fieldsV1:
f:status:
.:
f:presented:
f:processing:
f:reason:
f:state:
Manager: controller
Operation: Update
Subresource: status
Time: 2021-11-29T11:04:22Z
Owner References:
API Version: acme.cert-manager.io/v1
Block Owner Deletion: true
Controller: true
Kind: Order
Name: letsencrypt-something-cert-fkzs5-1375084254
UID: 1bbe18b7-9275-4dc4-872d-bc5f5abf497c
Resource Version: 7041118
UID: 4541df79-bb14-4961-bfb1-e068fe2d6c81
Spec:
Authorization URL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/811518411
Dns Name: something-doe.com
Issuer Ref:
Group: cert-manager.io
Kind: ClusterIssuer
Name: letsencrypt-staging
Key: 382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8.Wa-UGUzSApW6EVdbEjJqi-qm7JT76a5T8VhTQOTz2Zo
Solver:
http01:
Ingress:
Class: nginx
Token: 382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8
Type: HTTP-01
URL: https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/811518411/rvlRdw
Wildcard: false
Status:
Presented: true
Processing: true
Reason: Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
Events: <none>
State: pending
k describe ingress cm-acme-http-solver-9xg4n
Name: cm-acme-http-solver-9xg4n
Namespace: default
Address: 139.178.91.167
Default backend: default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
Rules:
Host Path Backends
---- ---- --------
something-doe.com
/.well-known/acme-challenge/382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8 cm-acme-http-solver-l55kd:8089 (11.233.0.51:8089)
Annotations: nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
Events: <none>
k describe ingress api-ingress
Name: api-ingress
Namespace: default
Address: 139.178.91.167
Default backend: default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
letsencrypt-something-cert terminates something-doe.com
Rules:
Host Path Backends
---- ---- --------
something-doe.com
/ something-front:5000 (11.233.0.41:5000,11.233.0.42:5000)
app.something-doe.com
/ something-back:3000 (11.233.0.13:3000,11.233.0.14:3000)
Annotations: cert-manager.io/cluster-issuer: letsencrypt-staging
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/rewrite-target: /
Events: <none>
If I call the acme challenge seems to work
curl http://something-doe.com/.well-known/acme-challenge/322z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8
# 382z5Tloq5AQftHg4q1ldxRPseTDJIZvAR4jQX_L8X8.Wa-UGUzSApW22fdbEjJqi-qm7JT76a5T8VhTQOTz2Zo%
I do not know what else to do/check
Upvotes: 0
Views: 1930
Reputation: 3570
I faced this issue when I was using a NAT rule in pfSense to forward traffic into my cluster. I switched to using the pfSense haproxy and it worked fine after that.
Upvotes: 0
Reputation: 818
Thanks for all the help. the Issue was solved with a workaround https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841
basically the cert manager pod was unable to access the service pod. Seems a dns or something blocking the http call, redirecting to https and the cert-manager fails
So to avoid go-out and go-in again
k -n cert-manager edit deployment cert-manager
and add in spec
spec:
...
hostAliases:
- hostnames:
- something-do.com
ip: 138.178.91.111 # server IP
this will add that line to the /etc/hosts
so will call directly to your service
Upvotes: 1