2

I'm getting this error in wildcard certificate challenge:

Error presenting challenge: Found no Zones for domain _acme-challenge.my-domain.com. (neither in the sub-domain noir in the SLD) please make sure your domain-entries in the config are correct and the API is correctly setup with Zone.read rights.

I'm using Cloudflare as the DNS01 Challenge Provider and have set up the API token with the permissions described in the cert-manager documentation.

My cluster issuer looks like this:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: test-issuer
spec:
  acme:
    email: <email>
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: test-issuer-private-key
    solvers:
    - dns01:
        cloudflare:
          email: <email>
          apiTokenSecretRef:
            name: issuer-access-token
            key: api-token

And my certificate:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: test-wildcard
spec:
  secretName: test-wildcard-tls
  issuerRef:
    name: test-issuer
    kind: ClusterIssuer
  dnsNames:
  - "*.my-domain.com"

I have CNAME record with ‘*’ name that points to my domain and an A record that points to my Kubernetes cluster IP.

Am I missing something? How do you correctly set up cert-manager to automatically manage wildcard domain with Cloudflare as DNS01 Challenge Provider?

jjustas
  • 31
  • 1
  • 4

1 Answers1

2

I've run into this issue as well, and I realized that I made two different errors in my configuration.

#1: I had overlooked that the API Token that you generate must have all of the following permissions and zone resources associated to it:

  • Permissions
    • Zone.Zone.Read
    • Zone.Zone.Edit
  • Zone Resources
    • Include.All zones

This is in the docs but clearly I wasn't reading correctly.

#2: I wasn't able to make it work with the dnsNames attribute in the Certificate resource, but rather needed to use dnsZones instead. In your example, try changing from:

  dnsNames:
  - "*.my-domain.com"

to:

  dnsZones:
  - "my-domain.com"

According to this docs (emphasis mine):

Note: dnsNames take an exact match and do not resolve wildcards, meaning the following Issuer will not solve for DNS names such as foo.example.com. Use the dnsZones selector type to match all subdomains within a zone.

This should generate a certificate with a CN of *.my-domain.com and with both *.my-domain.com and my-domain.com in the subjectAltName field.

9numbernine9
  • 53
  • 6
  • 1
    Thank you very much for the answer. But when I try to add the `dnsZones` attribute to `Certificate` resource it throws an error: error validating data: `ValidationError(Certificate.spec): unknown field "dnsZones" in io.cert-manager.v1.Certificate.spec;`. Isn't the `dnsZones` key only for issuer selectors? – jjustas Nov 09 '21 at 12:40
  • 1
    I ran into the same issue, verify permissions and that the token is valid, that made the trick for me – r4cc00n Jul 16 '23 at 12:01