Question 98059 in Nginx Question posted in
The official documentation can be found here.

Cert-manager "remote error: tls: unrecognized name" errors – Nginx

I’m having an issue trying to create certs with cert-manager in a GKE cluster. This has to be something I am doing on my end as I have tried versions, 1.7.1, 1.7.0, and 1.6.2 with all getting the same error.

The error I am seeing is:

E0219 00:57:39.270717       1 sync.go:186] cert-manager/controller/challenges "msg"="propagation check failed" "error"="failed to perform self check GET request 'http://mysubdomain.mmydomain.com/.well-known/acme-challenge/secretKey': Get "https://mysubdomain.mmydomain.com:443/.well-known/acme-challenge/secretKey": remote error: tls: unrecognized name" "dnsName"="mysubdomain.mmydomain.com" "resource_kind"="Challenge" "resource_name"="elasticsearch-tls-cert-somenumbers" "resource_namespace"="elastic-stack" "resource_version"="v1" "type"="HTTP-01"

This is the setup I went though to install:

Install CRDs
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml

Helm install cert-manager

helm install 
  cert-manager jetstack/cert-manager 
  --namespace cert-manager 
  --create-namespace 
  --version v1.7.1

Confirmed install is good:

➜  ~ helm list -n cert-manager
NAME            NAMESPACE       REVISION    UPDATED                                 STATUS      CHART               APP VERSION
cert-manager    cert-manager    1           2022-02-18 16:07:57.258172 -0800 PST    deployed    cert-manager-v1.6.2 v1.6.2
➜  ~

Applied the ClusterIssuer:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    email: "[email protected]"
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
        ingress:
          class: nginx

Deployed my ingress:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: kibana-ingress
  namespace: elastic-stack
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
spec:
  rules:
  - host: mysubdomain.mmydomain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kibana-kb-http
          servicePort: 5601
  tls:
    - hosts:
      - mysubdomain.mmydomain.com
      secretName: kibana-tls-cert

Then when I tail the cert-manager pods I see the remote error: tls: unrecognized name" "dnsName error.

A describe of the cert challenge says the same thing:

Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://mysubdomain.mmydomain.com/.well-known/acme-challenge/secretKey': Get "https://mysubdomain.mmydomain.com:443/.well-known/acme-challenge/secretKey": remote error: tls: unrecognized name
  State:       pending
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Started    8m45s  cert-manager  Challenge scheduled for processing
  Normal  Presented  8m45s  cert-manager  Presented challenge using HTTP-01 challenge mechanism

This works totally fine in another cluster, so I cannot figure out what I am doing wrong here.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    The issue ended up being that I used a different nginx chart in my second cluster by mistake, so the configs for the ingress were different, and in turn not working. I switched the chart on my second cluster to the one that I used in my first cluster, and every thing worked.


  2. 0

    Just to elaborate more on this.

    The error for me as well had to do with using the nginx-stable chart which cert-manager does not support instead of the ingress-nginx chart.

    So instead of this:

    helm repo add nginx-stable https://helm.nginx.com/stable
helm repo update
helm upgrade --install nginx-ingress nginx-stable/nginx-ingress 
  --namespace nginx-ingress 
  --create-namespace 
  --timeout 600s 
  --debug
  --set controller.publishService.enabled=true

    Use this to install ingress-nginx:

    helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx 
  --namespace ingress-nginx 
  --create-namespace 
  --timeout 600s 
  --debug 
  --set controller.publishService.enabled=true

    And then install cert-manager:

    helm repo add jetstack https://charts.jetstack.io
helm repo update
helm upgrade --install cert-manager jetstack/cert-manager 
  --namespace cert-manager 
  --create-namespace 
  --atomic 
  --version v1.8.2 
  --set installCRDs=true
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search