Error 503 using cert-manager

Hello,

I’m using cert-manager version 0.10.1 and my certificates are not getting generated. Here is the full error:

cert-manager/controller/challenges "msg"="propagation check failed" "error"="wrong status code '503', expected '200'" "dnsName"="nantes.apecconnect.apec.fr" "resource_kind"="Challenge" "resource_name"="nantes.apecconnect.apec.fr-cert-3638574816-0" "resource_namespace"="eventmaker" "type"="http-01"

Looks like letsenncrypt returns a 503 status code when I want to request a challenge. Anyone know what may be going on ? I’m blacklisted ? Same thing when I try with another domain …

1 Like

Can you try to upgrade your cert-manager?
The latest version is 0.12.0

On 0.11.0 cert-manager changed name (website) for their API spaces due to upstream policy, so your 503 error might caused by one of the API changed since the old domain is no longer available.

1 Like

Hi @robinmonjo

that’s not a Letsencrypt error, that’s a check of cert-manager.

Cert-manager expects http status 200, but sees a 503.

But curious: There are checks of your domain, ~~20 minutes old - https://check-your-website.server-daten.de/?q=nantes.apecconnect.apec.fr

There is no http status 503 visible.

–>> check, if there is an update, perhaps an internal bug.

1 Like

Thank you all for your answers, I just deleted my ingresses having trouble and recreated them and everything went back to normal. I plan to upgrade cert-manager but transitioning from 0.10 to 0.11 seems risky … Will tackle this another day :slight_smile:

1 Like

My guess is that I had a couple of domains not properly configured (at the DNS Level) so cert-manager was looping constantly and ask letsencrypt to validate a challenge. These requests made the letsencrypt API blacklist me and answer me with 503 everytime. I cleaned up the domains, wait 10 minutes to let the letsencrypt API have some rest and created my domains again and it works. Is this a possible scenario ?

1 Like

If your dns is wrong, the cert-manager precheck can’t work.

1 Like

Yes exactly but that were domains that used to be properly configured then customers changed the CNAME. I’m pretty sure the letsencrypt API have some kind of rate limiting after this experience. Having a confirmation about this would comfort me as we rely a lot on letsencrypt …

1 Like

That’s the reason the precheck may not work.

Rate limits have the status 429, not 503. And the error isn’t a Letsencrypt error, these look completely different.

1 Like

Ok so I’m in the dark on what happened … I’ll keep a close look at my logs. Anyway I know I can get quick help here that’s awesome, again thank you !

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.