Answers: <p>I have less reputation to add this in comment, are you sure your domain.com is resolving to said IP, ,and any .htacess or any rule preventing it, sometimes it take time to resolve and it route to old domain.com</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-11T15:41:18.820Z
Answers: if I ping my domain, resolve the correct IP. But how can I check the whole flow manually? maybe from inside a pod? (Sorry I'm not a devop, so my K experience is too little)
Answers: Math
Answers: CC BY-SA 4.0
Answers: 2021-10-11T16:13:06.850Z
Answers: you can login to pod?
Answers: Siddique Ahmad
Answers: CC BY-SA 4.0
Answers: 2021-10-12T01:28:23.593Z
Answers: nop, no bash, sh :(
Answers: Math
Answers: CC BY-SA 4.0
Answers: 2021-10-12T03:54:19.057Z
Answers: on bare metal there can be many reasons, my suggestion is to try docker cert manager and see if all working fine
Answers: Siddique Ahmad
Answers: CC BY-SA 4.0
Answers: 2021-10-12T12:30:51.330Z
Answers: ok, I can try that. At least there are some steps to try to see what's happens?
Answers: Math
Answers: CC BY-SA 4.0
Answers: 2021-10-12T17:37:36.443Z
Answers: good, we can solve it don't worry
Answers: Siddique Ahmad
Answers: CC BY-SA 4.0
Answers: 2021-10-17T02:39:29.943Z
Answers: did you get it fixed ?
Answers: Siddique Ahmad
Answers: CC BY-SA 4.0
Answers: 2021-10-18T03:17:18.510Z
Answers: nop. i don’t know how to troubleshoot it
Answers: Math
Answers: CC BY-SA 4.0
Answers: 2021-10-18T17:29:53.830Z
Answers: we can chat sometime on weekend
Answers: Siddique Ahmad
Answers: CC BY-SA 4.0
Answers: 2021-10-19T19:17:45.913Z
Answers: cool thx too much!
Answers: Math
Answers: CC BY-SA 4.0
Answers: 2021-10-11T04:00:17.463Z
Answers: 2021-10-11T04:00:17.463Z
Answers: Siddique Ahmad
Answers: <p>Thanks for all the help. the Issue was solved with a workaround <a href="https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841" rel="nofollow noreferrer">https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841</a></p>
  <p>basically the cert manager pod was unable to access the service pod. Seems a dns or something blocking the http call, redirecting to https and the cert-manager fails</p>
  <p>So to avoid go-out and go-in again</p>
  <pre class="lang-sh prettyprint-override"><code>k -n cert-manager edit deployment cert-manager
  </code></pre>
  <p>and add in <code>spec</code></p>
  <pre class="lang-yml prettyprint-override"><code>spec:
    ...
    hostAliases:
      - hostnames:
        - something-do.com
        ip: 138.178.91.111 # server IP
  </code></pre>
  <p>this will add that line to the <code>/etc/hosts</code> so will call directly to your service</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-08T10:53:00.460Z
Answers: 2021-11-08T10:53:00.460Z
Answers: Math
Body: <p>I', trying to configure a cert-manager in a Baremetal server. I followed <a href="https://cert-manager.io/docs/installation/helm/#installing-with-helm" rel="nofollow noreferrer">this link</a> &amp; <a href="https://www.fosstechnix.com/kubernetes-nginx-ingress-controller-letsencrypt-cert-managertls/" rel="nofollow noreferrer">this one</a></p>
  <p>the <code>k describe challenge my-domain.com-xqwh4-4005106243-2059835058</code></p>
  <p>get</p>
  <pre><code>Status:
    Presented:   true
    Processing:  true
    Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
    State:       pending
  Events:
    Type    Reason     Age    From          Message
    ----    ------     ----   ----          -------
    Normal  Started    2m27s  cert-manager  Challenge scheduled for processing
    Normal  Presented  2m26s  cert-manager  Presented challenge using HTTP-01 challenge mechanism
  </code></pre>
  <p>the <code>k describe order my-domain.com-xqwh4-4005106243</code> has <code>State: pending</code></p>
  <p>the <code>k describe certificate my-domain.com</code></p>
  <pre><code>Status:
    Conditions:
      Last Transition Time:        2021-10-11T01:30:50Z
      Message:                     Issuing certificate as Secret does not exist
      Observed Generation:         1
      Reason:                      DoesNotExist
      Status:                      False
      Type:                        Ready
      Last Transition Time:        2021-10-11T01:30:50Z
      Message:                     Issuing certificate as Secret does not exist
      Observed Generation:         1
      Reason:                      DoesNotExist
      Status:                      True
      Type:                        Issuing
  </code></pre>
  <p>If a call directly the <a href="http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow" rel="nofollow noreferrer">http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow</a> it works well</p>
  <p>Any idea how to troubleshoot it?
  I tried all the things from <a href="https://cert-manager.io/docs/faq/troubleshooting/" rel="nofollow noreferrer">https://cert-manager.io/docs/faq/troubleshooting/</a></p>
  <p>the cert ingress</p>
  <pre><code>kind: Ingress
  apiVersion: networking.k8s.io/v1
  metadata:
    name: cm-acme-http-solver-plvqx
    generateName: cm-acme-http-solver-
    namespace: default
    uid: 9a9f6829-3b89-4990-9038-f45285a4ae92
    resourceVersion: '3155628'
    generation: 1
    creationTimestamp: '2021-10-11T01:30:52Z'
    labels:
      acme.cert-manager.io/http-domain: '1019414173'
      acme.cert-manager.io/http-token: '902303313'
      acme.cert-manager.io/http01-solver: 'true'
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
    ownerReferences:
      - apiVersion: acme.cert-manager.io/v1
        kind: Challenge
        name: my-domain.com-xqwh4-4005106243-2059835058
        uid: 03bd05a0-d39d-4377-ad2a-43963b4ea9b9
        controller: true
        blockOwnerDeletion: true
    managedFields:
      - manager: controller
        operation: Update
        apiVersion: networking.k8s.io/v1
        time: '2021-10-11T01:30:52Z'
        fieldsType: FieldsV1
        fieldsV1:
          f:metadata:
            f:annotations:
              .: {}
              f:nginx.ingress.kubernetes.io/whitelist-source-range: {}
            f:generateName: {}
            f:labels:
              .: {}
              f:acme.cert-manager.io/http-domain: {}
              f:acme.cert-manager.io/http-token: {}
              f:acme.cert-manager.io/http01-solver: {}
            f:ownerReferences:
              .: {}
              k:{&quot;uid&quot;:&quot;03bd05a0-d39d-4377-ad2a-43963b4ea9b9&quot;}: {}
          f:spec:
            f:ingressClassName: {}
            f:rules: {}
      - manager: nginx-ingress-controller
        operation: Update
        apiVersion: networking.k8s.io/v1
        time: '2021-10-11T01:31:13Z'
        fieldsType: FieldsV1
        fieldsV1:
          f:status:
            f:loadBalancer:
              f:ingress: {}
        subresource: status
  spec:
    ingressClassName: nginx
    rules:
      - host: my-domain.com
        http:
          paths:
            - path: &gt;-
                /.well-known/acme-challenge/mIHD-FglhGgu-QV-NSMHzTtTCneahED5Ns7HpTfABow
              pathType: ImplementationSpecific
              backend:
                service:
                  name: cm-acme-http-solver-22qx2
                  port:
                    number: 8089
  status:
    loadBalancer:
      ingress:
        - ip: 137.100.90.100
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2021-10-15T12:35:42.637Z
Comments: What version of cert manager are you using? Can you share nginx/htaccess configuration?
Comments: Kyslik
Comments: CC BY-SA 4.0
Comments: 2021-10-16T14:23:21.817Z
Comments: v1.5.4.
  
  ingress edited bellow
Comments: Math
Comments: CC BY-SA 4.0
Comments: 2021-10-30T13:50:20.977Z
Comments: tried with 1.6 but the same. posted too
  https://stackoverflow.com/questions/69780209/kubernetes-cert-manager-issue-in-baremetal-waiting-for-http-01-challenge-propag
Comments: Math
Tags: <kubernetes><cert-manager><letsencrypt>
Title: Unable to configure cert-manager. Wrong status code '403', expected '200'
UserDisplayName: Math
ThreadText: # Unable to configure cert-manager. Wrong status code '403', expected '200'
  
  (Asked by: username_0 on 2021-10-11)
  
  I', trying to configure a cert-manager in a Baremetal server. I followed [this link](https://cert-manager.io/docs/installation/helm/#installing-with-helm) & [this one](https://www.fosstechnix.com/kubernetes-nginx-ingress-controller-letsencrypt-cert-managertls/)
  
  the `k describe challenge my-domain.com-xqwh4-4005106243-2059835058`
  
  get
  
  ```
  Status:
    Presented:   true
    Processing:  true
    Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '403', expected '200'
    State:       pending
  Events:
    Type    Reason     Age    From          Message
    ----    ------     ----   ----          -------
    Normal  Started    2m27s  cert-manager  Challenge scheduled for processing
    Normal  Presented  2m26s  cert-manager  Presented challenge using HTTP-01 challenge mechanism
  
  ```
  
  the `k describe order my-domain.com-xqwh4-4005106243` has `State: pending`
  
  the `k describe certificate my-domain.com`
  
  ```
  Status:
    Conditions:
      Last Transition Time:        2021-10-11T01:30:50Z
      Message:                     Issuing certificate as Secret does not exist
      Observed Generation:         1
      Reason:                      DoesNotExist
      Status:                      False
      Type:                        Ready
      Last Transition Time:        2021-10-11T01:30:50Z
      Message:                     Issuing certificate as Secret does not exist
      Observed Generation:         1
      Reason:                      DoesNotExist
      Status:                      True
      Type:                        Issuing
  
  ```
  
  If a call directly the <http://my-domain.com/.well-known/acme-challenge/xxx-xxx-xx-NSMHzTtTCneahED5Ns7HpTfABow> it works well
  
  Any idea how to troubleshoot it?
  I tried all the things from <https://cert-manager.io/docs/faq/troubleshooting/>
  
  the cert ingress
  
  ```
  kind: Ingress
  apiVersion: networking.k8s.io/v1
  metadata:
    name: cm-acme-http-solver-plvqx
    generateName: cm-acme-http-solver-
    namespace: default
    uid: 9a9f6829-3b89-4990-9038-f45285a4ae92
    resourceVersion: '3155628'
    generation: 1
    creationTimestamp: '2021-10-11T01:30:52Z'
    labels:
      acme.cert-manager.io/http-domain: '1019414173'
      acme.cert-manager.io/http-token: '902303313'
      acme.cert-manager.io/http01-solver: 'true'
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
    ownerReferences:
      - apiVersion: acme.cert-manager.io/v1
        kind: Challenge
        name: my-domain.com-xqwh4-4005106243-2059835058
        uid: 03bd05a0-d39d-4377-ad2a-43963b4ea9b9
        controller: true
        blockOwnerDeletion: true
    managedFields:
      - manager: controller
        operation: Update
        apiVersion: networking.k8s.io/v1
        time: '2021-10-11T01:30:52Z'
        fieldsType: FieldsV1
        fieldsV1:
          f:metadata:
            f:annotations:
              .: {}
              f:nginx.ingress.kubernetes.io/whitelist-source-range: {}
            f:generateName: {}
            f:labels:
              .: {}
              f:acme.cert-manager.io/http-domain: {}
              f:acme.cert-manager.io/http-token: {}
              f:acme.cert-manager.io/http01-solver: {}
            f:ownerReferences:
              .: {}
              k:{"uid":"03bd05a0-d39d-4377-ad2a-43963b4ea9b9"}: {}
          f:spec:
            f:ingressClassName: {}
            f:rules: {}
      - manager: nginx-ingress-controller
        operation: Update
        apiVersion: networking.k8s.io/v1
        time: '2021-10-11T01:31:13Z'
        fieldsType: FieldsV1
        fieldsV1:
          f:status:
            f:loadBalancer:
              f:ingress: {}
        subresource: status
  spec:
    ingressClassName: nginx
    rules:
      - host: my-domain.com
        http:
          paths:
            - path: >-
                /.well-known/acme-challenge/mIHD-FglhGgu-QV-NSMHzTtTCneahED5Ns7HpTfABow
              pathType: ImplementationSpecific
              backend:
                service:
                  name: cm-acme-http-solver-22qx2
                  port:
                    number: 8089
  status:
    loadBalancer:
      ingress:
        - ip: 137.100.90.100
  
  ```
  
  **Tags:** kubernetes, cert-manager, letsencrypt
  
  > **Comments:**
  > **username_1**: What version of cert manager are you using? Can you share nginx/htaccess configuration?  
  > **username_0**: v1.5.4.  ingress edited bellow  
  > **username_0**: tried with 1.6 but the same. posted too https://stackoverflow.com/questions/69780209/kubernetes-cert-manager-issue-in-baremetal-waiting-for-http-01-challenge-propag  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2021-10-11. Score: 0
  
  I have less reputation to add this in comment, are you sure your domain.com is resolving to said IP, ,and any .htacess or any rule preventing it, sometimes it take time to resolve and it route to old domain.com
  
  > **Comments:**
  > **username_0**: if I ping my domain, resolve the correct IP. But how can I check the whole flow manually? maybe from inside a pod? (Sorry I'm not a devop, so my K experience is too little)  
  > **username_2**: you can login to pod?  
  > **username_0**: nop, no bash, sh :(  
  > **username_2**: on bare metal there can be many reasons, my suggestion is to try docker cert manager and see if all working fine  
  > **username_0**: ok, I can try that. At least there are some steps to try to see what's happens?  
  > **username_2**: good, we can solve it don't worry  
  > **username_2**: did you get it fixed ?  
  > **username_0**: nop. i don’t know how to troubleshoot it  
  > **username_2**: we can chat sometime on weekend  
  > **username_0**: cool thx too much!  
  
  ---
  
  ### Answer by username_0 on 2021-11-08. Score: 0
  
  Thanks for all the help. the Issue was solved with a workaround <https://github.com/jetstack/cert-manager/issues/4003#issuecomment-904420841>
  
  basically the cert manager pod was unable to access the service pod. Seems a dns or something blocking the http call, redirecting to https and the cert-manager fails
  
  So to avoid go-out and go-in again
  
  ```sh
  k -n cert-manager edit deployment cert-manager
  
  ```
  
  and add in `spec`
  
  ```yml
  spec:
    ...
    hostAliases:
      - hostnames:
        - something-do.com
        ip: 138.178.91.111 # server IP
  
  ```
  
  this will add that line to the `/etc/hosts` so will call directly to your service
  
  
  ---
  
  