Unable to create wildcard certificate #23
Comments
|
That's the selectors. Now to request the wildcard certificate:
|
Can you check the content of the challenge to see if there an error HTTP 401 = authentication issue please ? @GhataEmbectaTest |
|
I'm facing the same issue, the created challenge is in a pending state and produces this log. Does anyone know whats the problem? |
Can you check the content of the challenge and paste here please (see: https://cert-manager.io/docs/troubleshooting/acme/#3-troubleshooting-challenges) ? |
|
Dear @cmoulliard, Sure i will provide full details. apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: [email protected]
privateKeySecretRef:
name: letsencrypt-prod-account-key
solvers:
- selector:
dnsNames:
- '*.rigt.online'
dns01:
webhook:
config:
apiKeySecretRef:
name: godaddy-api-key-prod
key: key
secret: secret
production: true
ttl: 600
groupName: acme.rigt.online
solverName: godaddyCertificate apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wildcard-rigt-online
namespace: default
spec:
secretName: wildcard-yourdomain-com-tls
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
commonName: '*.rigt.online'
dnsNames:
- '*.rigt.online'Full content of the challenge Name: wildcard-rigt-online-1-177342043-3278775856
Namespace: default
Labels: <none>
Annotations: <none>
API Version: acme.cert-manager.io/v1
Kind: Challenge
Metadata:
Creation Timestamp: 2023-10-30T08:59:50Z
Finalizers:
finalizer.acme.cert-manager.io
Generation: 1
Owner References:
API Version: acme.cert-manager.io/v1
Block Owner Deletion: true
Controller: true
Kind: Order
Name: wildcard-rigt-online-1-177342043
UID: 1b611778-1bdc-476a-9326-750f482e6553
Resource Version: 3575405
UID: 79db4b46-6c6c-45de-abf9-8f8fab39e335
Spec:
Authorization URL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/278591822466
Dns Name: rigt.online
Issuer Ref:
Kind: ClusterIssuer
Name: letsencrypt-prod
Key: xgJC0_InXJoGr8Vw80cs0gwMa41rnDEDl4d-CXCR0dc
Solver:
dns01:
Webhook:
Config:
API Key Secret Ref:
Key: key
Name: godaddy-api-key-prod
Secret: secret
Production: true
Ttl: 600
Group Name: acme.rigt.online
Solver Name: godaddy
Selector:
Dns Names:
*.rigt.online
Token: wYknK7WtDe-ThJwCVmqGj9uGBj8I2c2QiCVZFT2cYmQ
Type: DNS-01
URL: https://acme-v02.api.letsencrypt.org/acme/chall-v3/278591822466/UH9rWw
Wildcard: true
Status:
Presented: false
Processing: true
Reason: the server is currently unable to handle the request (post godaddy.acme.rigt.online)
State: pending
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Started 8s cert-manager-challenges Challenge scheduled for processing
Warning PresentError 3s (x3 over 8s) cert-manager-challenges Error presenting challenge: the server is currently unable to handle the request (post godaddy.acme.rigt.online) |
Can you format your YAML files please using fenced code block https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks#fenced-code-blocks ? |
Sorry about that, I've edited my comment. |
|
I think that you should go trough the list of the resources created by the cert manager to see if another error has been reported as events (= kubectl describe ...) or status (= kubectl get ... -oyaml) : |
|
The certificate resource indicates that some secret is missing but I don't know what dose it means. Name: wildcard-rigt-online
Namespace: default
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1
Kind: Certificate
Metadata:
Creation Timestamp: 2023-10-30T08:59:48Z
Generation: 1
Resource Version: 3575373
UID: 4d7c84f1-4f42-4bc0-b8d8-3a35569d7ae7
Spec:
Common Name: *.rigt.online
Dns Names:
*.rigt.online
Issuer Ref:
Kind: ClusterIssuer
Name: letsencrypt-prod
Secret Name: wildcard-yourdomain-com-tls
Status:
Conditions:
Last Transition Time: 2023-10-30T08:59:48Z
Message: Issuing certificate as Secret does not exist
Observed Generation: 1
Reason: DoesNotExist
Status: False
Type: Ready
Last Transition Time: 2023-10-30T08:59:48Z
Message: Issuing certificate as Secret does not exist
Observed Generation: 1
Reason: DoesNotExist
Status: True
Type: Issuing
Next Private Key Secret Name: wildcard-rigt-online-ttlb5
Events: <none>
Order resource Name: wildcard-rigt-online-1-177342043
Namespace: default
Labels: <none>
Annotations: cert-manager.io/certificate-name: wildcard-rigt-online
cert-manager.io/certificate-revision: 1
cert-manager.io/private-key-secret-name: wildcard-rigt-online-ttlb5
API Version: acme.cert-manager.io/v1
Kind: Order
Metadata:
Creation Timestamp: 2023-10-30T08:59:48Z
Generation: 1
Owner References:
API Version: cert-manager.io/v1
Block Owner Deletion: true
Controller: true
Kind: CertificateRequest
Name: wildcard-rigt-online-1
UID: ad2a21f0-7a88-4d62-ae35-1e6874121b8f
Resource Version: 3575396
UID: 1b611778-1bdc-476a-9326-750f482e6553
Spec:
Common Name: *.rigt.online
Dns Names:
*.rigt.online
Issuer Ref:
Kind: ClusterIssuer
Name: letsencrypt-prod
Request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2xUQ0NBWDBDQVFBd0dERVdNQlFHQTFVRUF3d05LaTV5YVdkMExtOXViR2x1WlRDQ0FTSXdEUVlKS29aSQpodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU1CbTRqWm1pdExieWFxSHBGektWY2VNR0I2NU9ZQXhrZVhCCk9rdndHSkpBY3VPSlhFZHJXZXp1Y1ZlTmQ1eFVlMEYvdlY0b200WW9QK3FaUklpSU43TnhmOWliS1JJeGR6VGwKeitOWEtZSnpXbTh0dHY1elAweEN3bGs4RzlwUVM1ZU92RG1YMUgxdHV6RFBUV3YzbDdPVnpSU2pIa2NXRjAvNwplVEFHdFM0MWpKSFR1VnUvZkFHRlR1K1RuVVkvcnZtVDB4aDk0VlpjK2FpWm1jUFM0ZW9wNUtNYVRhUkdVR1NyCnBDWnJNK2pKenc2bmtKMFRobjNYUW52aEplRFZ6MktDdzRKSGptbnpPL0FQMUtnR2ppSll0N1VUellpU3pPY2wKNlh3YmxGclgzaG5xaUpqenJIMFMydHNtQkZDQW93WVVOLytzVnBjOVNHUW0wUXFQUU0wQ0F3RUFBYUE0TURZRwpDU3FHU0liM0RRRUpEakVwTUNjd0dBWURWUjBSQkJFd0Q0SU5LaTV5YVdkMExtOXViR2x1WlRBTEJnTlZIUThFCkJBTUNCYUF3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUtTVXZVcldQTTRkZjZtSklpSzJvM1NhQXFwVlk4eDQKd3hSdTFKMzNrdmRjYythb2FCbXBMd05uUy91NDkrWWZzR1NSWlhCbjVIa2poUDFLak9FM000c2FqTjhLV25sQwpJMEl4ZXZaR0ZWSit4SkVHVnRCS25FVVJEajVwSElSM0VRRGZkdEJSdDRieDFlQmUzNTE2TjJkUEp3eXV3aXpRCnNscG1maDJMOEt1a2hINUJibzBYUEVnaVpjd0lCdGdJbndCRXNnSVNxRS9GNHpkQTlNdEQ3ZEJWdDZUbDBGTU8KcXU0Y0NIOHJJTlBCMXoxdjA1eXJCcjFwWlh1WFNrYWNvV3dKV0JSUVNweVRhMWtIYmxkdmRSQnZ0Wjl5RzN2NgpDT3owMWJIZ3BiZS9PMUo3MUhvc3pscStHUUdlcm0wamZMdis2a09RdjQ1M1dpZ0xobTRCOGg4PQotLS0tLUVORCBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K
Status:
Authorizations:
Challenges:
Token: wYknK7WtDe-ThJwCVmqGj9uGBj8I2c2QiCVZFT2cYmQ
Type: dns-01
URL: https://acme-v02.api.letsencrypt.org/acme/chall-v3/278591822466/UH9rWw
Identifier: rigt.online
Initial State: pending
URL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/278591822466
Wildcard: true
Finalize URL: https://acme-v02.api.letsencrypt.org/acme/finalize/1385199376/218649226056
State: pending
URL: https://acme-v02.api.letsencrypt.org/acme/order/1385199376/218649226056
Events: <none>
Also I'm running my kubeadm cluster under a strict network firewall. dose that have anything to do with that ? do I need to open any ports? |
This message happens (if I dont say something wrong) when no secret containing the TLS cert + key has been yet generated by Letsencrypt from DNS challenge response (= that it got from godaddy) and what finally triggers the creation of the CertificateRequest CR |
Maybe if HTTP traffic is blocked between your VM running the kube cluster and godaddy. Can you check on godaddy web site if a TXT record containing the ACME challenge for your domain name (see discussion https://stackoverflow.com/questions/63346728/issuing-certificate-as-secret-does-not-exist) exists ? |
|
I've tested the entire process across various environments, including a kind cluster and DigitalOcean Managed Kubernetes. I've also experimented with different domains, and each scenario has resulted in the same error message: Warning PresentError 32s (x2 over 32s) cert-manager-challenges Error presenting challenge: the server could not find the requested resource (post godaddy.acme.smsmtrivia.com)
It's evident that this issue is rooted in the webhook plugin, and I believe it's crucial to open a new issue to address and resolve this problem. |
Can you check the following points please:
|
|
FYI: I use cert manager v1.12 + this godaddy webhook on a VPN (= behind a firewall) and my certificates are well rotated. Here is the last order issued some hours ago |
I am using cert-manager with my AKS cluster to generate Lets Encrypt certificates for my database using this webhook. Facing issue with certificate generation with error: secret not found in secret
Steps followed following the link: https://cert-manager.io/docs/configuration/acme/dns01/
Command used: helm upgrade -i godaddy-webhook godaddy-webhook/godaddy-webhook --set groupName=acme.mydomain.com --set image.tag=v1.24.6 --set image.pullPolicy=Always --set pod.securePort=8443 --namespace cert-manager –debug
Deployment is successful.
5. Created a certificate
apiVersion: cert-manager.io/v1
Issuing certificate as Secret does not exist”
Also attached cert-manager pod logs for more details.
cert-manager/challenges/Present "msg"="presenting DNS01 challenge for domain" "dnsName"="cmmx.mydomain.com" "domain"="cmmx.mydomain.com" "resource_kind"="Challenge" "resource_name"="couchbasecertificate-th2jp-71168170-2435339236" "resource_namespace"="cert-manager" "resource_version"="v1" "type"="DNS-01" 1 controller.go:166] cert-manager/challenges "msg"="re-queuing item due to error processing" "error"="secret not found in secret \"godaddy-api-key/cert-manager\"" "key"="cert-manager/couchbasecertificate-th2jp-71168170-2435339236"The text was updated successfully, but these errors were encountered: