I want to order a certificate using cert-manager in my kubernetes cluster running istio. Unfortunately my certificate wasn't orderd correclty by cert-manager. In the logs of my cert-manager pod I found this message getting spammed over and over:

cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="istio-system/controller-certificate-1405129842-0"

cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="istio-system/controller-certificate-1405129842-0"

cert-manager/controller/challenges/http01/selfCheck/http01/ensurePod "level"=0 "msg"="found one existing HTTP01 solver pod" "dnsName"="<somename>.westeurope.cloudapp.azure.com" "related_resource_kind"="Pod" "related_resource_name"="cm-acme-http-solver-6k5fk" "related_resource_namespace"="istio-system" "reso
urce_kind"="Challenge" "resource_name"="controller-certificate-1405129842-0" "resource_namespace"="istio-system" "type"="http-01"

cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for
challenge resource" "dnsName"="<somename>.westeurope.cloudapp.azure.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-wkz8d" "related_r
esource_namespace"="istio-system" "resource_kind"="Challenge" "resource_name"="controller-certificate-1405129842-0" "resource_namespace"="istio-system" "type"="http-01"

cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dn
sName"="<somename>.westeurope.cloudapp.azure.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-8b6lf" "related_resource_namespace"="ist
io-system" "resource_kind"="Challenge" "resource_name"="controller-certificate-1405129842-0" "resource_namespace"="istio-system" "type"="http-01"

cert-manager/controller/challenges "msg"="propagation check failed" "error"="wrong status code '404', expected '200'" "dnsName"="
.westeurope.cloudapp.azure.com" "resource_kind"="Challenge" "resource_name"="controller-certificate-1405129842-0" "resource_namespace"="istio-system" "type"="http-01"

I'm using Kubernetes 1.9.9 running in Azure in combination with Istio. I want the certificate for the istio-ingressgateway so i can expose my services with https over the ingressgateway loadbalancer. Im not sure why and what exactly is returning the error code 404?

I tried following this tutorial: https://medium.com/@gregoire.waymel/istio-cert-manager-lets-encrypt-demystified-c1cbed011d67.

This is my gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: test-gateway
  #namespace: istio-system
  labels:
    app: ingressgateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      protocol: HTTPS
      name: https-default
    tls:
      mode: SIMPLE
      serverCertificate: "sds"
      privateKey: "sds"
      credentialName: "controller-certificate"
    hosts:
    - "*"

...and this is my other gateway according to the tutorial:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-autogenerated-k8s-ingress
  namespace: istio-system
  labels:
    app: ingressgateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      protocol: HTTP2
      name: http
    hosts:
    - "*"

This is how my certificate looks like.

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: controller-certificate
  namespace: istio-system
spec:
  secretName: controller-certificate
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: <somename>.westeurope.cloudapp.azure.com
  dnsNames:
  - <somename>.westeurope.cloudapp.azure.com
  acme:
    config:
    - http01:
        ingressClass: istio
      domains:
      - <somename>.westeurope.cloudapp.azure.com

Does anyone have an idea what to look for or what might cause the error code 404 in this case?