In OpenShift CRC (Code Ready Containers) environments, I try to use cert-manager and Let's Encrypt to apply for certificate, but the certificate request gets stuck and ends up with "waiting" status.

My ClusterIssuer looks like:

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: barry-letsencrypt
spec:
  acme:
    email: me@abc.com
    http01: {}
    privateKeySecretRef:
      name: barry-letsencrypt-private-key
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress:
          class: nginx
      selector: {}

After running the above YAML file, ClusterIssuer has been created successfully.

My certificate looks like:

apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager-test
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: example-com
  namespace: cert-manager-test
spec:
  secretName: example-com-tls
  duration: 24h
  renewBefore: 12h
  commonName: example.com
  dnsNames:
  - example.com
  issuerRef:
    name: barry-letsencrypt
    kind: ClusterIssuer
    #kind: Issuer
    group: cert-manager.io

After running the above YAML file I check if my secret object has been created, but tls.cert is 0 bytes.

# oc -n cert-manager-test describe secret example-com-tls
Name:         example-com-tls
Namespace:    cert-manager-test
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: example-com
              cert-manager.io/issuer-kind: ClusterIssuer
              cert-manager.io/issuer-name: barry-letsencrypt

Type:  kubernetes.io/tls

Data
====
ca.crt:   0 bytes
tls.crt:  0 bytes
tls.key:  1679 bytes

Then I check Certificate status, it shows:

# oc -n cert-manager-test describe certificate.cert-manager.io example-com
Name:         example-com
Namespace:    cert-manager-test
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha2
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-01-21T21:53:43Z
  Generation:          1
  Resource Version:    11111249
  Self Link:           /apis/cert-manager.io/v1alpha2/namespaces/cert-manager-test/certificates/example-com
  UID:                 7e1d5876-3c98-11ea-84cc-52fdfc072182
Spec:
  Common Name:  example.com
  Dns Names:
    example.com
    www.example.com
  Duration:  24h0m0s
  Issuer Ref:
    Group:       cert-manager.io
    Kind:        ClusterIssuer
    Name:        barry-letsencrypt
  Renew Before:  12h0m0s
  Secret Name:   example-com-tls
Status:
  Conditions:
    Last Transition Time:  2020-01-21T21:53:43Z
    Message:               Waiting for CertificateRequest "example-com-3700695519" to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age    From          Message
  ----    ------        ----   ----          -------
  Normal  GeneratedKey  7m41s  cert-manager  Generated a new private key
  Normal  Requested     7m41s  cert-manager  Created new CertificateRequest resource "example-com-3700695519"

Obviously, Certificate request is stuck.

What is wrong here? Why does the certificate request end up in waiting status? Is it caused by Code Ready Containers (not sure if CRC has route to access outside)?