<p>I have less reputation to add this in comment, are you sure your domain.com is resolving to said IP, ,and any .htacess or any rule preventing it, sometimes it take time to resolve and it route to old domain.com</p>

CC BY-SA 4.0
2021-10-11T15:41:18.820Z
if I ping my domain, resolve the correct IP. But how can I check the whole flow manually? maybe from inside a pod? (Sorry I'm not a devop, so my K experience is too little)
Math
CC BY-SA 4.0
2021-10-11T16:13:06.850Z
you can login to pod?
Siddique Ahmad
CC BY-SA 4.0
2021-10-12T01:28:23.593Z
nop, no bash, sh :(
Math
CC BY-SA 4.0
2021-10-12T03:54:19.057Z
on bare metal there can be many reasons, my suggestion is to try docker cert manager and see if all working fine
Siddique Ahmad
CC BY-SA 4.0
2021-10-12T12:30:51.330Z
ok, I can try that. At least there are some steps to try to see what's happens?
Math
CC BY-SA 4.0
2021-10-12T17:37:36.443Z
good, we can solve it don't worry
Siddique Ahmad
CC BY-SA 4.0
2021-10-17T02:39:29.943Z
did you get it fixed ?
Siddique Ahmad
CC BY-SA 4.0
2021-10-18T03:17:18.510Z
nop. i don’t know how to troubleshoot it
Math
CC BY-SA 4.0
2021-10-18T17:29:53.830Z
we can chat sometime on weekend
Siddique Ahmad
CC BY-SA 4.0
2021-10-19T19:17:45.913Z
cool thx too much!
Math
CC BY-SA 4.0
2021-10-11T04:00:17.463Z
2021-10-11T04:00:17.463Z
Siddique Ahmad
<p>Thanks for all the help. the Issue was solved with a workaround <a href="https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841" rel="nofollow noreferrer">https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841</a></p>
<p>basically the cert manager pod was unable to access the service pod. Seems a dns or something blocking the http call, redirecting to https and the cert-manager fails</p>
<p>So to avoid go-out and go-in again</p>
<pre class="lang-sh prettyprint-override"><code>k -n cert-manager edit deployment cert-manager
</code></pre>
<p>and add in <code>spec</code></p>
<pre class="lang-yml prettyprint-override"><code>spec:
  ...
  hostAliases:
    - hostnames:
      - something-do.com
      ip: 138.178.91.111 # server IP
</code></pre>
<p>this will add that line to the <code>/etc/hosts</code> so will call directly to your service</p>

CC BY-SA 4.0
2021-11-08T10:53:00.460Z
2021-11-08T10:53:00.460Z
Math
<p>I', trying to configure a cert-manager in a Baremetal server. I followed <a href="https://cert-manager.io/docs/installation/helm/#installing-with-helm" rel="nofollow noreferrer">this link</a> &amp; <a href="https://www.fosstechnix.com/kubernetes-nginx-ingress-controller-letsencrypt-cert-managertls/" rel="nofollow noreferrer">this one</a></p>
<p>the <code>k describe challenge my-domain.com-xqwh4-4005106243-2059835058</code></p>
<p>get</p>
<pre><code>Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
  State:       pending
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Started    2m27s  cert-manager  Challenge scheduled for processing
  Normal  Presented  2m26s  cert-manager  Presented challenge using HTTP-01 challenge mechanism
</code></pre>
<p>the <code>k describe order my-domain.com-xqwh4-4005106243</code> has <code>State: pending</code></p>
<p>the <code>k describe certificate my-domain.com</code></p>
<pre><code>Status:
  Conditions:
    Last Transition Time:        2021-10-11T01:30:50Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2021-10-11T01:30:50Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
</code></pre>
<p>If a call directly the <a href="http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow" rel="nofollow noreferrer">http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow</a> it works well</p>
<p>Any idea how to troubleshoot it?
I tried all the things from <a href="https://cert-manager.io/docs/faq/troubleshooting/" rel="nofollow noreferrer">https://cert-manager.io/docs/faq/troubleshooting/</a></p>
<p>the cert ingress</p>
<pre><code>kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: cm-acme-http-solver-plvqx
  generateName: cm-acme-http-solver-
  namespace: default
  uid: 9a9f6829-3b89-4990-9038-f45285a4ae92
  resourceVersion: '3155628'
  generation: 1
  creationTimestamp: '2021-10-11T01:30:52Z'
  labels:
    acme.cert-manager.io/http-domain: '1019414173'
    acme.cert-manager.io/http-token: '902303313'
    acme.cert-manager.io/http01-solver: 'true'
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  ownerReferences:
    - apiVersion: acme.cert-manager.io/v1
      kind: Challenge
      name: my-domain.com-xqwh4-4005106243-2059835058
      uid: 03bd05a0-d39d-4377-ad2a-43963b4ea9b9
      controller: true
      blockOwnerDeletion: true
  managedFields:
    - manager: controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2021-10-11T01:30:52Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:nginx.ingress.kubernetes.io/whitelist-source-range: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:acme.cert-manager.io/http-domain: {}
            f:acme.cert-manager.io/http-token: {}
            f:acme.cert-manager.io/http01-solver: {}
          f:ownerReferences:
            .: {}
            k:{&quot;uid&quot;:&quot;03bd05a0-d39d-4377-ad2a-43963b4ea9b9&quot;}: {}
        f:spec:
          f:ingressClassName: {}
          f:rules: {}
    - manager: nginx-ingress-controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2021-10-11T01:31:13Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:loadBalancer:
            f:ingress: {}
      subresource: status
spec:
  ingressClassName: nginx
  rules:
    - host: my-domain.com
      http:
        paths:
          - path: &gt;-
              /.well-known/acme-challenge/mIHD-FglhGgu-QV-NSMHzTtTCneahED5Ns7HpTfABow
            pathType: ImplementationSpecific
            backend:
              service:
                name: cm-acme-http-solver-22qx2
                port:
                  number: 8089
status:
  loadBalancer:
    ingress:
      - ip: 137.100.90.100
</code></pre>

CC BY-SA 4.0
2021-10-15T12:35:42.637Z
What version of cert manager are you using? Can you share nginx/htaccess configuration?
Kyslik
CC BY-SA 4.0
2021-10-16T14:23:21.817Z
v1.5.4.

ingress edited bellow
Math
CC BY-SA 4.0
2021-10-30T13:50:20.977Z
tried with 1.6 but the same. posted too
https://stackoverflow.com/questions/69780209/kubernetes-cert-manager-issue-in-baremetal-waiting-for-http-01-challenge-propag
Math
<kubernetes><cert-manager><letsencrypt>
Unable to configure cert-manager. Wrong status code '403', expected '200'
Math
# Unable to configure cert-manager. Wrong status code '403', expected '200'

(Asked by: username_0 on 2021-10-11)

I', trying to configure a cert-manager in a Baremetal server. I followed this link & this one
the k describe challenge my-domain.com-xqwh4-4005106243-2059835058
get
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
  State:       pending
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Started    2m27s  cert-manager  Challenge scheduled for processing
  Normal  Presented  2m26s  cert-manager  Presented challenge using HTTP-01 challenge mechanism

the k describe order my-domain.com-xqwh4-4005106243 has State: pending
the k describe certificate my-domain.com
Status:
  Conditions:
    Last Transition Time:        2021-10-11T01:30:50Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2021-10-11T01:30:50Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing

If a call directly the http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow it works well
Any idea how to troubleshoot it?
I tried all the things from https://cert-manager.io/docs/faq/troubleshooting/
the cert ingress
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: cm-acme-http-solver-plvqx
  generateName: cm-acme-http-solver-
  namespace: default
  uid: 9a9f6829-3b89-4990-9038-f45285a4ae92
  resourceVersion: '3155628'
  generation: 1
  creationTimestamp: '2021-10-11T01:30:52Z'
  labels:
    acme.cert-manager.io/http-domain: '1019414173'
    acme.cert-manager.io/http-token: '902303313'
    acme.cert-manager.io/http01-solver: 'true'
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  ownerReferences:
    - apiVersion: acme.cert-manager.io/v1
      kind: Challenge
      name: my-domain.com-xqwh4-4005106243-2059835058
      uid: 03bd05a0-d39d-4377-ad2a-43963b4ea9b9
      controller: true
      blockOwnerDeletion: true
  managedFields:
    - manager: controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2021-10-11T01:30:52Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:nginx.ingress.kubernetes.io/whitelist-source-range: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:acme.cert-manager.io/http-domain: {}
            f:acme.cert-manager.io/http-token: {}
            f:acme.cert-manager.io/http01-solver: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"03bd05a0-d39d-4377-ad2a-43963b4ea9b9"}: {}
        f:spec:
          f:ingressClassName: {}
          f:rules: {}
    - manager: nginx-ingress-controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2021-10-11T01:31:13Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:loadBalancer:
            f:ingress: {}
      subresource: status
spec:
  ingressClassName: nginx
  rules:
    - host: my-domain.com
      http:
        paths:
          - path: >-
              /.well-known/acme-challenge/mIHD-FglhGgu-QV-NSMHzTtTCneahED5Ns7HpTfABow
            pathType: ImplementationSpecific
            backend:
              service:
                name: cm-acme-http-solver-22qx2
                port:
                  number: 8089
status:
  loadBalancer:
    ingress:
      - ip: 137.100.90.100

**Tags:** kubernetes, cert-manager, letsencrypt

> **Comments:**
> **username_1**: What version of cert manager are you using? Can you share nginx/htaccess configuration?  
> **username_0**: v1.5.4.  ingress edited bellow  
> **username_0**: tried with 1.6 but the same. posted too https://stackoverflow.com/questions/69780209/kubernetes-cert-manager-issue-in-baremetal-waiting-for-http-01-challenge-propag  

---

## 2 answers

### Answer by username_2 on 2021-10-11. Score: 0

I have less reputation to add this in comment, are you sure your domain.com is resolving to said IP, ,and any .htacess or any rule preventing it, sometimes it take time to resolve and it route to old domain.com

> **Comments:**
> **username_0**: if I ping my domain, resolve the correct IP. But how can I check the whole flow manually? maybe from inside a pod? (Sorry I'm not a devop, so my K experience is too little)  
> **username_2**: you can login to pod?  
> **username_0**: nop, no bash, sh :(  
> **username_2**: on bare metal there can be many reasons, my suggestion is to try docker cert manager and see if all working fine  
> **username_0**: ok, I can try that. At least there are some steps to try to see what's happens?  
> **username_2**: good, we can solve it don't worry  
> **username_2**: did you get it fixed ?  
> **username_0**: nop. i don’t know how to troubleshoot it  
> **username_2**: we can chat sometime on weekend  
> **username_0**: cool thx too much!  

---

### Answer by username_0 on 2021-11-08. Score: 0

Thanks for all the help. the Issue was solved with a workaround https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841
basically the cert manager pod was unable to access the service pod. Seems a dns or something blocking the http call, redirecting to https and the cert-manager fails
So to avoid go-out and go-in again
k -n cert-manager edit deployment cert-manager

and add in spec
spec:
  ...
  hostAliases:
    - hostnames:
      - something-do.com
      ip: 138.178.91.111 # server IP

this will add that line to the /etc/hosts so will call directly to your service


---

