Cert-manager: error constructing Challenge resource for authorization: no configured challenge solvers can be used for this challenge

[ronakthamor]

Describe the bug:
I am getting below error upon installing clusterissuer and certificate on AKS and it's not issuing certificate from letsencrypt. I also tried with matchLabels and adding same label in certificate. But, same issue.

error constructing Challenge resource for authorization: no configured challenge solvers can be used for this challenge

Steps to reproduce the bug:
Apply this config in AKS cluster for your service.

ClusterIssuer:

---
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
    name: letsencrypt-staging
spec:
    acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
        name: letsencrypt-staging
    solvers:
    - selector: 
                 dnsNames:
                 - example.com
                 - api2.example.com
                 - apm-server.example.com
      dns01:
          azuredns:
        clientID: xxxxx
        clientSecretSecretRef:
            name: azuredns-config
            key: CLIENT_SECRET
        subscriptionID: xxxxx
        tenantID: xxxxx
        resourceGroupName: xxxxx
        hostedZoneName: example.com
        environment: AzurePublicCloud

Certificate:

---
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: service-crt
  namespace: istio-system
spec:
  secretName: service-crt
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: example.com
  dnsNames:
  - "example.com"

Environment details::

• Kubernetes version: v1.10.4
• Cloud-provider/provisioner: AKS
• cert-manager version: v0.9.0
• Install method: Istio plugin - helm chart

/kind bug

[munnerz]

Please can you upgrade to v0.11.0 and update this issue with the most recent results? The solvers implementation is now the default, and we've made improvements to it since v0.9.0 😄

[adauhajre]

I am also seeing this problem using route53 and v0.12.0
cert-manager-788fb8fdf-pnrnh cert-manager E1208 04:42:43.587413 1 sync.go:111] cert-manager/controller/orders "msg"="Failed to determine the list of Challenge resources needed for the Order" "error"="no configured challenge solvers can be used for this challenge" "resource_kind"="Order"
issuer:

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-iss
  namespace: cert-manager
spec:
  acme:
    email: xxxxxx
    privateKeySecretRef:
      name: letsencrypt-iss-key
    server: https://acme-staging-v02.api.letsencrypt.org/directory

  solvers:
    - selector:
      dnsZones:
        - "example.com"
      dns01:
        route53:
          hostedZoneID: xxxx
          accessKeyID: xxxxx
          region: us-west-2
          secretAccessKeySecretRef:
            key: secret-access-key
            name: aws-cert-manager

certificate:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ingress-certs
spec:
  dnsNames:
    - "example.com"
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-iss
  secretName: ex-secret

_EDIT_: The issue was my solver was not under the acme block.

[hpohl]

I was missing the acme block in the Certificate as well, but why is it gone from the docs? https://cert-manager.io/docs/usage/certificate/

v0.12.0

[suda]

@hpohl how did you apply Certificate with acme block? I'm getting ValidationError(Certificate.spec): unknown field "acme" in io.cert-manager.v1alpha2.Certificate.spec when trying

[hpohl]

This works for me:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: example
  namespace: istio-system
spec:
  secretName: example
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer

  dnsNames:
  - 'example.com'

  acme:
    config:
    - dns01:
        provider: cloudflare
      domains:
      - 'example.com'

[suda]

@hpohl do you have your CRD's at version 0.12.0 as well? Because they no longer contain the acme field and trying to apply your example _should_ fail I assume.

[hpohl]

@suda I do have the CRDs at version 0.12.0. But I also have the certmanager.k8s.io/disable-validation: "true" label on the cert-manager namespace still.

[tellisnz-shift]

I had an issue similar to this, but it was when i changed the solver from httop01 to dns01 on an existing letsencrypt issuer, after recently creating a new cert on http01. When the order was created I got into a weird state of having two authorizations on it, one with http01 and the second with dns01. It seemed like cert manager only tried to use the first and saw that only http01 was authorized but i was trying to use dns01, and gave up.

I corrected it but deleting the letsencrypt issuer secret, so I guess got a whole new account + new order + new authorization that this time matched on dns01 and was able to receive my cert.

[Frederik-Baetens]

I'm also having this issue, i'm trying to use http validation.

this is my certificate resource:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - "*.quivr.be"
  issuerRef:
    kind: Issuer
    name: letsencrypt-prod
  secretName: wildcard-cert

and my issuer:

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [email protected]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx

Can i not use the http solver? Or what's going wrong here?

I'm using cert-manager 0.13, deployed from the quickstart guide (manually without helm)

[munnerz]

HTTP01 cannot be used to obtain wildcard certificates - you’ll need to use
DNS01 validation instead 🙂

On Sat, 8 Feb 2020 at 18:52, Frederik-Baetens [e-mail]
wrote:

I'm also having this issue, i'm trying to use http validation.

this is my certificate resource:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: wildcard-cert
spec:
dnsNames:

• "*.quivr.be"
  issuerRef:
  kind: Issuer
  name: letsencrypt-prod
  secretName: wildcard-cert

and my issuer:

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: letsencrypt-prod
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: [email protected]
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: nginx

Can i not use the http solver? Or what's going wrong here?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/jetstack/cert-manager/issues/2127?email_source=notifications&email_token=AABRWP73SVPIFJC7RE7T52DRB35OFA5CNFSM4I3HEOHKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELFY6MI#issuecomment-583765809,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AABRWPZX3OJXI3WSSUDFZWTRB35OFANCNFSM4I3HEOHA
.