NGINX issue: Unable to issue certificate

[mpgxvii]

Hi @K1Hyve , the cert-manager is unable to issue a certificate in one of our envs. These are the logs from describing one of the challenges.

Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://subdomain.radar-base.net/.well-known/acme-challenge/[...]': Get "http://subdomain.radar-base.net/.well-known/acme-challenge/[...]": dial tcp 192.168.2.66:80: connect: connection timed out
  State:       pending
Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Started    3m27s  cert-manager  Challenge scheduled for processing
  Normal  Presented  3m26s  cert-manager  Presented challenge using HTTP-01 challenge mechanism

Cert-manager logs:

I0727 14:43:06.545723       1 pod.go:59] cert-manager/challenges/http01/selfCheck/http01/ensurePod "msg"="found one existing HTTP01 solver pod" "dnsName"="graylog.stage.radar-base.net" "related_resource_kind"="Pod" "related_resource_name"="cm-acme-http-solver-hp9r6" "related_resource_namespace"="graylog" "related_resource_version"="v1" "resource_kind"="Challenge" "resource_name"="radar-base-tls-zcwj6-1475635968-347456507" "resource_namespace"="graylog" "resource_version"="v1" "type"="HTTP-01" 
I0727 14:43:06.545845       1 service.go:43] cert-manager/challenges/http01/selfCheck/http01/ensureService "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="graylog.stage.radar-base.net" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-82fc4" "related_resource_namespace"="graylog" "related_resource_version"="v1" "resource_kind"="Challenge" "resource_name"="radar-base-tls-zcwj6-1475635968-347456507" "resource_namespace"="graylog" "resource_version"="v1" "type"="HTTP-01" 
I0727 14:43:06.545942       1 ingress.go:99] cert-manager/challenges/http01/selfCheck/http01/ensureIngress "msg"="found one existing HTTP01 solver ingress" "dnsName"="graylog.stage.radar-base.net" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-hfnlf" "related_resource_namespace"="graylog" "related_resource_version"="v1" "resource_kind"="Challenge" "resource_name"="radar-base-tls-zcwj6-1475635968-347456507" "resource_namespace"="graylog" "resource_version"="v1" "type"="HTTP-01" 

Nginx logs:

ring/radar-base-tls-prometheus was not found. Using default certificate
W0727 14:43:26.337223       7 controller.go:1333] Error getting SSL certificate "monitoring/radar-base-tls-grafana": local SSL certificate monitoring/radar-base-tls-grafana was not found. Using default certificate
W0727 14:43:26.337239       7 controller.go:1333] Error getting SSL certificate "monitoring/radar-base-tls-alertmanager": local SSL certificate monitoring/radar-base-tls-alertmanager was not found. Using default certificate
W0727 14:43:26.337253       7 controller.go:1333] Error getting SSL certificate "default/radar-base-tls": local SSL certificate default/radar-base-tls was not found. Using default certificate
W0727 14:43:26.337270       7 controller.go:1333] Error getting SSL certificate "default/radar-base-tls-dashboard": local SSL certificate default/radar-base-tls-dashboard was not found. Using default certificate
W0727 14:43:26.337283       7 controller.go:1298] Server snippet already configured for server "stage.radar-base.net", skipping (Ingress "default/radar-gateway")
W0727 14:43:26.337298       7 controller.go:1298] Server snippet already configured for server "stage.radar-base.net", skipping (Ingress "default/radar-push-endpoint")

I also tried helmfile destroy and deleting the leftover resources (as mentioned in the README). I also tried uninstalling only cert-manager and installing again but it's a similar error about not being able to get the SSL certificate.

Thank you!

[yatharthranjan]

In the Reason --

  Reason:      Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://subdomain.radar-base.net/.well-known/acme-challenge/[...]': Get "http://subdomain.radar-base.net/.well-known/acme-challenge/[...]": dial tcp 192.168.2.66:80: connect: connection timed out

what is subdomain ? Seems like a placeholder?

[mpgxvii]

Yes in the actual logs it's the staging subdomain. 😅

[keyvaann]

It says 192.168.2.66:80: connect: connection timed out, are you able to connect to the subdomains yourself?

[mpgxvii]

Hi all, this has been fixed, I was using the wrong subnet configuration. Thanks!