Lets Encrypt DNS challenge using HTTP

Question

I'm trying to setup a Let's Encrypt certificate on Google Cloud. I recently changed it from http01 to dns01 challenge type so that I could create Cloud DNS zones and the acme challenge TXT record would automatically be added.

Here's my certificate.yaml

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata: 
  name: san-tls
  namespace: default
spec:
  secretName: san-tls
  issuerRef: 
    name: letsencrypt
  commonName: www.evolut.net
  altNames: 
  - portal.evolut.net
  dnsNames:
    - www.evolut.net
    - portal.evolut.net
  acme: 
    config: 
    - dns01:
        provider: clouddns
      domains:
      - www.evolut.net
      - portal.evolut.net

However now I get the following error when I kubectl describe certificate:

 Message:               DNS names on TLS certificate not up to date: ["portal.evolut.net" "www.evolut.net"]
    Reason:                DoesNotMatch
    Status:                False
    Type:                  Ready

More worryingly, when I kubectl describe order I see the following:

Status:
  Challenges:
    Authz URL:  https://acme-v02.api.letsencrypt.org/acme/authz/redacted
    Config:
      Http 01:
    Dns Name:  portal.evolut.net
    Issuer Ref:
      Kind:     Issuer
      Name:     letsencrypt
    Key:        redacted
    Token:      redacted
    Type:       http-01
    URL:        https://acme-v02.api.letsencrypt.org/acme/challenge/redacted
    Wildcard:   false
    Authz URL:  https://acme-v02.api.letsencrypt.org/acme/authz/redacted
    Config:
      Http 01:

Notice how the Type is always http-01, although in the certificate they are listed under dns01.

This means that the ACME TXT file is never created in Cloud DNS and of course the domains aren't validated.

score 0 · Answer 1 · answered Jun 03 '19 at 10:33

0

This seems to be related an issue related to the use of multiple domains. I suggest the use of two different namespaces. You can check an example in the following link:

Failed to list *v1alpha1.Order: orders.certmanager.k8s.io is forbidden

answered Jun 03 '19 at 10:33

Lozano

170
6

Lets Encrypt DNS challenge using HTTP

1 Answers1