Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: davidshen84.duckdns.org
I ran this command:
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: letsencrypt-staging
namespace: cert-manager
spec:
acme:
email: davidshen84@---
server: https://acme-staging-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: letsencrypt-staging-issuer-account-key
solvers:
- http01:
gatewayHTTPRoute:
parentRefs:
- name: traefik-gateway
namespace: kube-system
kind: Gateway
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: letsencrypt-staging
namespace: cert-manager
spec:
issuerRef:
name: letsencrypt-staging
kind: Issuer
secretName: letsencrypt-staging-tls
dnsNames:
- davidshen84.duckdns.org
emailAddresses:
- davidshen84@---
It produced this output:
After a while, after the solver pod as been deleted, I got this:
Failed to wait for order resource "letsencrypt-staging-1-2542508985" to become ready: order is in "invalid" state:
My web server is (include version): traefik gateway
The operating system my web server runs on is (include version): linux, k3s
My hosting provider, if applicable, is: n/a
I can login to a root shell on my machine (yes or no, or I don't know): no
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): n/a
From the log of the challenge solver, I found these messages:
I0802 06:55:57.992856 1 solver.go:104] "comparing token" logger="cert-manager.acmesolver" host="davidshen84.duckdns.org" path="/.well-known/acme-challenge/toke-redacted" base_path="/.well-known/acme-challenge" token="toke-redacted" headers={"Accept-Encoding":["gzip"],"User-Agent":["cert-manager-challenges/v1.18.2 (linux/amd64) cert-manager/686afa62160249022a0205d3a9bf5f059476c684"],"X-Forwarded-For":["2001:cafe:42::1"],"X-Forwarded-Host":["davi shen84.duckdns.org"[],"X-Forwarded-Port":["80"],"X-Forwarded-Proto":["http"],"X-Forwarded-Server":["traefik-5dd8bf4ff-lzgsd"],"X-Real-Ip":["2001:cafe:42::1"]} expected_token="toke-redacted"
I0802 06:55:57.992872 1 solver.go:112] "got successful challenge request, writing key" logger="cert-manager.acmesolver" host="davidshen84.duckdns.org" path="/.well-known/acme-challenge/toke-redacted" base_path="/.well-known/acme-challenge" token="toke-redacted" headers={"Accept-Encoding":["gzip"],"User-Agent":["cert-manager-challenges/v1.18.2 (linux/amd64) cert-manager/686afa62160249022a0205d3a9bf5f059476c684"],"X-Forwarded-For":["2001:cafe:42:1"[],"X-Forwarded-Host":["davidshen84.duckdns.org"],"X-Forwarded-Port":["80"],"X-Forwarded-Proto":["http"],"X-Forwarded-Server":["traefik-5dd8bf4ff-lzgsd"],"X-Real-Ip":["2001:cafe:42::1"]}
I0802 06:55:59.995587 1 solver.go:89] "validating request" logger="cert-manager.acmesolver" host="davidshen84.duckdns.org" path="/.well-known/acme-challenge/toke-redacted" base_path="/.well-known/acme-challenge" token="toke-redacted" headers={"Accept-Encoding":["gzip"],"User-Agent":["cert-manager-challenges/v1.18.2 (linux/amd64) cert-manager/686afa62160249022a0205d3a9bf5f059476c684"],"X-Forwarded-For":["2001:cafe:42::1"],"X-Forwarded-Host":["daidshen84.duckdns.org"[],"X-Forwarded-Port":["80"],"X-Forwarded-Proto":["http"],"X-Forwarded-Server":["traefik-5dd8bf4ff-lzgsd"],"X-Real-Ip":["2001:cafe:42::1"]}
I0802 06:55:59.995633 1 solver.go:97] "comparing host" logger="cert-manager.acmesolver" host="davidshen84.duckdns.org" path="/.well-known/acme-challenge/toke-redacted" base_path="/.well-known/acme-challenge" token="toke-redacted" headers={"Accept-Encoding":["gzip"],"User-Agent":["cert-manager-challenges/v1.18.2 (linux/amd64) cert-manager/686afa62160249022a0205d3a9bf5f059476c684"],"X-Forwarded-For":["2001:cafe:42::1"],"X-Forwarded-Host":["davidsen84.duckdns.org"[],"X-Forwarded-Port":["80"],"X-Forwarded-Proto":["http"],"X-Forwarded-Server":["traefik-5dd8bf4ff-lzgsd"],"X-Real-Ip":["2001:cafe:42::1"]} expected_host="davidshen84.duckdns.org"
I0802 06:55:59.995662 1 solver.go:104] "comparing token" logger="cert-manager.acmesolver" host="davidshen84.duckdns.org" path="/.well-known/acme-challenge/toke-redacted" base_path="/.well-known/acme-challenge" token="toke-redacted" headers={"Accept-Encoding":["gzip"],"User-Agent":["cert-manager-challenges/v1.18.2 (linux/amd64) cert-manager/686afa62160249022a0205d3a9bf5f059476c684"],"X-Forwarded-For":["2001:cafe:42::1"],"X-Forwarded-Host":["davishen84.duckdns.org"[],"X-Forwarded-Port":["80"],"X-Forwarded-Proto":["http"],"X-Forwarded-Server":["traefik-5dd8bf4ff-lzgsd"],"X-Real-Ip":["2001:cafe:42::1"]} expected_token="toke-redacted"
I0802 06:55:59.995680 1 solver.go:112] "got successful challenge request, writing key" logger="cert-manager.acmesolver" host="davidshen84.duckdns.org" path="/.well-known/acme-challenge/toke-redacted" base_path="/.well-known/acme-challenge" token="toke-redacted" headers={"Accept-Encoding":["gzip"],"User-Agent":["cert-manager-challenges/v1.18.2 (linux/amd64) cert-manager/686afa62160249022a0205d3a9bf5f059476c684"],"X-Forwarded-For":["2001:cafe:42:1"[],"X-Forwarded-Host":["davidshen84.duckdns.org"],"X-Forwarded-Port":["80"],"X-Forwarded-Proto":["http"],"X-Forwarded-Server":["traefik-5dd8bf4ff-lzgsd"],"X-Real-Ip":["2001:cafe:42::1"]}
Apparently, the letsencrypt issuer server can access my service. But evaultally, it failed to issue the certificate.
The only thing I am not certain is the ""X-Real-Ip":["2001:cafe:42::1"]" in the log. That is the IP of the service in my k8s cluster, not the public IP. I hope it doesn't matter.
