K
Q

Question

How do I test a ClusterIssuer solver?

10/17/2019

I'm attempting to deploy a Kubernetes cluster with an SSL certificate using LetsEncrypt on DigitalOcean. I followed these instructions, and everything works right up until the challenge order is created by the ClusterIssuer. Then I get this error:

cert-manager/controller/orders "msg"="Failed to determine the list of Challenge resources needed for the Order" "error"="no configured challenge solvers can be used for this challenge" "resource_kind"="Order" "resource_name"="letsencrypt-prod-cert-458163912-1173127706"

I've tried it both with http, and trying to configure DigitalOcean's dns01 resolver, but neither work, and with a similar error. The site is live by ip, by dns name (though I get the no-ssl cert warning). This is the ClusterIssuer description:

Name:         letsencrypt-issuer
Namespace:
Labels:       app/instance=webapp
              app/managed-by=Tiller
              app/name=webapp
              app/version=0.1.0
              helm.sh/chart=webapp-0.1.0
Annotations:  cert-manager.io/cluster-issuer: letsencrypt-issuer
              kubernetes.io/ingress.class: nginx
              kubernetes.io/tls-acme: true
API Version:  cert-manager.io/v1alpha2
Kind:         ClusterIssuer
Metadata:
  Creation Timestamp:  2019-10-16T23:24:47Z
  Generation:          2
  Resource Version:    10300992
  Self Link:           /apis/cert-manager.io/v1alpha2/clusterissuers/letsencrypt-issuer
  UID:                 2ee08cd4-5781-4126-9e6d-6b9d108a1eb2
Spec:
  Acme:
    Email:  <redacted>
    Private Key Secret Ref:
      Name:  letsencrypt-prod-cert
    Server:  https://acme-v02.api.letsencrypt.org/directory
Status:
  Acme:
    Last Registered Email:  <redacted>
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/69503670
  Conditions:
    Last Transition Time:  2019-10-16T23:24:48Z
    Message:               The ACME account was registered with the ACME server
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

Is there a way to see the solvers themselves to validate they're configured correctly? Is there a way to exercise them to prove they work? Is there some other way to diagnose what the situation is? I'm completely stuck, as there doesn't seem to be a lot of support online for this?

-- Nathaniel Ford

digital-ocean

kubernetes

lets-encrypt

1 Answer

10/17/2019

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
 metadata:
  name: certificate-name
spec:
  secretName: tls-cert
  duration: 24h
  renewBefore: 12h
  commonName: hostname
  dnsNames:
  - hostname
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer

apiVersion: certmanager.k8s.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    email: myemail@email.com
    http01: {}
    privateKeySecretRef:
      name: letsencrypt-private-key
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress:
          class: nginx
      selector: {}

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/acme-challenge-type: http01
    certmanager.k8s.io/cluster-issuer: letsencrypt
  name: ingress-rule
  namespace: default
spec:
  rules:
  - host: hostname
    http:
      paths:
      - backend:
          serviceName: backend-service
          servicePort: 8080
  tls:
  - hosts:
    - hostname
    secretName: tls-cert

The above cited approach worked for me, tls-cert is automatically generated in the intended namespace, the key and certificate both. For this to happen, you should point the IP of nginx loadbalancer to DNS

It worked for me, the acme challenge will get auto tested and the certificate will change it status from false to true, once this gets done

-- Tushar Mahajan

Source: StackOverflow

KQ

How do I test a ClusterIssuer solver?

Similar Questions

1 Answer

K
Q