Cert-manager: Failed to determine a valid solver configuration

[arkadyb]

I was trying to follow the dns01 challenge solver described here https://cert-manager.io/docs/configuration/acme/dns01/google/ however, the cert cant be fetched with order error says Failed to determine a valid solver configuration for the set of domains on the Order: no configured challenge solvers can be used for this challenge.

ClusterIssuer
Created in cert-manager namespace.

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt
 namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    # Staging
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Production
    #  server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [myemailaddress]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt
    # Enable the HTTP-01 challenge provider
    acme:
      solvers:
        - dns01:        
            clouddns:
              # The ID of the GCP project
              project: [project-id]
              # This is the secret used to access the service account
              serviceAccountSecretRef:
                name: clouddns-dns01-solver-svc-acct
                key: key.json

Certificate

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-tls
  namespace: sandpit
spec:
  secretName: my-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  commonName: '*.mydomain.com'
  dnsNames:
  - mydomain.com
  - '*.mydomain.com'

I also tried this configuration for Certificate:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-tls
  namespace: sandpit
spec:
  secretName: my-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  commonName: '*.mydomain.com'
  dnsNames:
  - mydomain.com
  - '*.mydomain.com'
  acme:
    config:
    - dns01:
        provider: clouddns
      domains:
      - mydomain.com
      - '*.mydomain.com'

The order created remains in pending state forever with Warning says:

Failed to determine a valid solver configuration for the set of domains on the Order: no configured challenge solvers can be used for this challenge

Why cant the solver be found?

[munnerz]

Your ClusterIssuer definition is incorrect:

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt
 namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    # Staging
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Production
    #  server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [myemailaddress]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt
    # Enable the HTTP-01 challenge provider
    acme:
      solvers:
        - dns01:        
            clouddns:
              # The ID of the GCP project
              project: [project-id]
              # This is the secret used to access the service account
              serviceAccountSecretRef:
                name: clouddns-dns01-solver-svc-acct
                key: key.json

should be:

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt
 namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    # Staging
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Production
    #  server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [myemailaddress]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt
    # Enable the HTTP-01 challenge provider
    solvers:
      - dns01:        
          clouddns:
            # The ID of the GCP project
            project: [project-id]
            # This is the secret used to access the service account
            serviceAccountSecretRef:
              name: clouddns-dns01-solver-svc-acct
              key: key.json

i.e. there should not be an additional acme: before the solvers: line

[retest-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[retest-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[meyskens]

/close

[jetstack-bot]

@meyskens: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.