# Unable to create certificate for Kubernetes web-app. cert-manager/challenges: propagation check failed" err="wrong status code '503', expected '200'" **URL:** \ **Category:** Help\ **Created:** [June 29, 2023, 2:26pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971 "2023-06-29T14:26:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Artyom2](https://avatars.discourse-cdn.com/v4/letter/a/57b2e6/32.png) [@Artyom2](https://community.letsencrypt.org/u/Artyom2)\ **Post date:** [June 29, 2023, 2:26pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/1 "2023-06-29T14:26:46Z")
Hello! I am working on deploying my app in k8s cluster. So, I decided to enable https connection to my application. I've created DNS name on the web-site Noip and connected it with the IP of my k8s cluster. After that, I deployed cert-manager, ClusterIssuer, Certificate and then Ingress. So, after applying a certificate i have the issue. Here are some logs of the pod of certificate-manager: ```plaintext I0629 13:50:39.836830 1 service.go:45] "cert-manager/challenges/http01/selfCheck/http01/ensureService: found one existing HTTP01 solver Service for challenge resource" resource_name="cert-pd292-3618130802-4138407347" resource_namespace="default" resource_kind="Challenge" resource_version="v1" dnsName="nodeart.bounceme.net" type=HTTP-01 related_resource_name="cm-acme-http-solver-k2vs5" related_resource_namespace="default" related_resource_kind="" related_resource_version="" I0629 13:50:39.836965 1 ingress.go:99] "cert-manager/challenges/http01/selfCheck/http01/ensureIngress: found one existing HTTP01 solver ingress" resource_name="cert-pd292-3618130802-4138407347" resource_namespace="default" resource_kind="Challenge" resource_version="v1" dnsName="nodeart.bounceme.net" type=HTTP-01 related_resource_name="cm-acme-http-solver-56pdn" related_resource_namespace="default" related_resource_kind="Ingress" related_resource_version="v1" E0629 13:50:39.840308 1 sync.go:190] "cert-manager/challenges: propagation check failed" err="wrong status code '503', expected '200'" resource_name="cert-pd292-3618130802-4138407347" resource_namespace="default" resource_kind="Challenge" resource_version="v1" dnsName="nodeart.bounceme.net" type=HTTP-01 ``` Can you help me with this, please? ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [June 29, 2023, 2:49pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/2 "2023-06-29T14:49:50Z")
Hello @Artyom2, welcome to the Let's Encrypt community. 🙂 Using the online tool [Let's Debug](https://letsdebug.net/) yields these results [https://letsdebug.net/nodeart.bounceme.net/1533951](https://letsdebug.net/nodeart.bounceme.net/1533951) ```plaintext ReservedAddress Fatal A private, inaccessible, IANA/IETF-reserved IP address was found for nodeart.bounceme.net. Let's Encrypt will always fail HTTP validation for any domain that is pointing to an address that is not routable on the internet. You should either remove this address and replace it with a public one or use the DNS validation method instead. 192.168.59.100 ``` The IPv4 address `192.168.59.100` is part of IPv4 Private Address Space and Filtering and cannot but used for the [HTTP-01 challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) of the [Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/) - [IPv4 Private Address Space and Filtering - American Registry for Internet Numbers](https://www.arin.net/reference/research/statistics/address_filters/#:~:text=According%20to%20standards%20set%20forth,0.0%20%E2%80%93%2010.255). - [Private network - Wikipedia](https://en.wikipedia.org/wiki/Private_network) ---
**Author:** ![Artyom2](https://avatars.discourse-cdn.com/v4/letter/a/57b2e6/32.png) [@Artyom2](https://community.letsencrypt.org/u/Artyom2)\ **Post date:** [June 29, 2023, 2:52pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/3 "2023-06-29T14:52:58Z")
it's the ip of my k8s cluster... but how can i reach the website? ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [June 29, 2023, 2:56pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/4 "2023-06-29T14:56:34Z")
Sorry but I do not know about` k8s clusters` Kindly wait to see if there are more knowledgeable Let's Encrypt community volunteers willing to assist. ---
**Author:** ![Artyom2](https://avatars.discourse-cdn.com/v4/letter/a/57b2e6/32.png) [@Artyom2](https://community.letsencrypt.org/u/Artyom2)\ **Post date:** [June 29, 2023, 2:57pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/5 "2023-06-29T14:57:32Z")
maybe you know the information about getting a certificate for your local dns? ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [June 29, 2023, 3:00pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/6 "2023-06-29T15:00:22Z")
Maybe this is of help [Certificates for localhost - Let's Encrypt](https://letsencrypt.org/docs/certificates-for-localhost/) ---
**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\ **Post date:** [June 29, 2023, 3:16pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/7 "2023-06-29T15:16:15Z")
There are al whole bunch of references answering your concern. READ ON! > [@Trying to create cert for internal-only server using DNS-01](https://community.letsencrypt.org/t/trying-to-create-cert-for-internal-only-server-using-dns-01/74375): > > A… > [@Let's Encrypt for Internal-Only Web Management](https://community.letsencrypt.org/t/lets-encrypt-for-internal-only-web-management/158154): > > I… > [@How to create certs for internal-use servers that use "real" domains](https://community.letsencrypt.org/t/how-to-create-certs-for-internal-use-servers-that-use-real-domains/74467): > > I… > [@Wildcard cert with internal-only subdomain](https://community.letsencrypt.org/t/wildcard-cert-with-internal-only-subdomain/71222): > > H… > [@Let's Encrypt on Non Internet Facing Internal Windows Servers](https://community.letsencrypt.org/t/lets-encrypt-on-non-internet-facing-internal-windows-servers/33833): > > O… ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [June 29, 2023, 5:18pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/8 "2023-06-29T17:18:22Z")
> [@Bruce5051](#): > > The IPv4 address `192.168.59.100` is part of IPv4 Private Address Space and Filtering and cannot but used for the [HTTP-01 challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) of the [Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/) Either: - switch to a public IP [might not be possible] - switch to DNS authentication [automation requires using a DSP, and ACME client, that support DNS zone updates via API] ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 29, 2023, 5:18pm UTC](https://community.letsencrypt.org/t/unable-to-create-certificate-for-kubernetes-web-app-cert-manager-challenges-propagation-check-failed-err-wrong-status-code-503-expected-200/200971/9 "2023-07-29T17:18:35Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.