I have a K8 AWS cluster on which I have many namespaces deployed. I want to configure Istio for my applications. I am using Cert-manager to manage the letsencrypt certificates. However, when I try to create issure+certificates using the Letsencrypt ACME URL - https://acme-staging-v02.api.letsencry…

[image] yashssh: I think the Letsencrypt is having problem. Very low probability for that. Try showing your route tables. and the output of: [image] rg305: traceroute -T -p 443 acme-v02.api.letsencrypt.org

[image] yashssh: Letsencrypt is not reachable from aws because it blocks requests from EC2 machines This has never been true.

Saw it here, old though. [image] Policy forbids issuing for name on Amazon EC2 domain Server a…

[image] yashssh: Saw it here, old though. That's a completely different statement. Let's Encrypt won't issue certs for *.amazonaws.com. That doesn't mean (as you claimed) that they block requests from EC2 machines.

That prevents you creating certificates that include that domain as a SAN. This is unrelated to the issue you are experiencing, which probably has to do with your VPC/NAT gateway configuration. Check that your server can make outbound connections to the internet at all, then do a traceroute to the…

[image] yashssh: When I try curl/ping to the above URL. It is not reachable. Try: traceroute -T -p 443 acme-v02.api.letsencrypt.org

I can access all the servers on internet but not Letsencrypt. I think the Letsencrypt is having problem.

Could be as simple as an incorrect route for the 172.16.0.0/12 subnet. (E.g., if instead of a /12 a /8 is mistakenly configured.)

traceroute to acme-v02.api.letsencrypt.org (172.65.32.248), 30 hops max, 46 byte packets 1 172-18-2-0.prometheus-prometheus-node-exporter.prometheus.xxx.xxxxx.local (172.18.2.0) 0.006 ms 0.005 ms 0.004 ms 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * *

So you're using the 172.16.0.0/12 as the internal network. Which for me makes a routing issue very likely. Please make sure the routing for your internal network is 172.16.0.0/12 and not e.g. /8.

I have never heard this IP range making network connection issues.

Cannot reach Let'sencrypt challenge url from AWS cluster

Help

yashssh May 17, 2023, 2:26pm 3

Saw it here, old though.

Topic		Replies	Views
Cert-manager letsencrypt certificate request fails with "authorization must be pending" Help	3	1771	January 11, 2022
Receiving time out error Help	6	170	March 22, 2025
Unable to get a certificate for AWS EC2 Help	5	6893	November 19, 2019
The client lacks sufficient authorization Help	4	634	June 12, 2020
Unable to generate new certificate on AWS Help	5	2538	February 13, 2018

Cannot reach Let'sencrypt challenge url from AWS cluster

Related topics