证书管理器挑战待定

Question

我正在使用证书管理器来管理我的 Kubernetes 集群中的 ssl 证书。证书管理器创建 pods 和挑战，但挑战从未得到满足。他们总是说：

Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://somedomain/.well-known/acme-challenge/VqlmMCsb019CCFDggs03RyBLZJ0jo53LO...': Get "http://somedomain/.well-known/acme-challenge/VqlmMCsb019CCFDggs03RyBLZJ0jo53LO...": EOF

但是当我打开 url (http:///.well-known/acme-challenge/VqlmMCsb019CCFDggs03RyBLZJ0jo53LO...) 时，它 returns 预期的代码：

vzCVdTk1q55MQCNH...zVkKYGvBJkRTvDBHQ.YfUcSfIKvWo_MIULP9jvYcgtsGxwfJMLWUGsB5kFKRc

当我执行 kubectl get certs 时，它表示证书已准备就绪：

姓名	准备就绪	秘密	年龄
crt1	正确	crt1-秘密	65米
crt1-秘密	正确	crt1-秘密	65米
crt2	正确	crt2-秘密	65米
crt2-秘密	正确	crt2-秘密	65米

看起来 Let's Encrypt 从未调用（或证书管理器从未指示）这些 url 来验证。

当我列出挑战 kubectl describe challenges 时，它说：

Name:         crt-secret-hcgcf-269956107-974455061
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  acme.cert-manager.io/v1
Kind:         Challenge
Metadata:
  Creation Timestamp:  2021-07-23T10:47:27Z
  Finalizers:
    finalizer.acme.cert-manager.io
  Generation:  1
  Managed Fields:
    API Version:  acme.cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:"finalizer.acme.cert-manager.io":
        f:ownerReferences:
          .:
          k:{"uid":"09e39ad0-cc39-421f-80d2-07c2f82680af"}:
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:authorizationURL:
        f:dnsName:
        f:issuerRef:
          .:
          f:group:
          f:kind:
          f:name:
        f:key:
        f:solver:
          .:
          f:http01:
            .:
            f:ingress:
              .:
              f:class:
              f:ingressTemplate:
    UID:                   09e39ad0-cc39-421f-80d2-07c2f82680af
  Resource Version:        19014474
  UID:                     b914ad18-2f5c-45cd-aa34-4ad7a2786536
Spec:
  Authorization URL:  https://acme-v02.api.letsencrypt.org/acme/authz-v3/1547...9301
  Dns Name:           mydomain.something
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   Issuer
    Name:   letsencrypt
  Key:      VqlmMCsb019CCFDggs03RyBLZ...nc767h_g.YfUcSfIKv...GxwfJMLWUGsB5kFKRc
  Solver:
    http01:
      Ingress:
        Class:  nginx
        Ingress Template:
          Metadata:
            Annotations:
              nginx.org/mergeable-ingress-type:  minion
        Service Type:                            ClusterIP
  Token:                                         VqlmMCsb019CC...03RyBLZJ0jo53LOiqnc767h_g
  Type:                                          HTTP-01
  URL:                                           https://acme-v02.api.letsencrypt.org/acme/chall-v3/15...49301/X--4pw
  Wildcard:                                      false
Events:                                          <none>

知道如何解决这个问题吗？

更新 1：

当我运行 curl http://some-domain.tld/.well-known/acme-challenge/VqlmMCsb019CC...gs03RyBLZJ0jo53LOiqnc767h_g 在另一个 pod 中时，它 returns:

curl: (52) Empty reply from server

当我在本地（在我的 PC 上）执行此操作时，它 returns 我得到了预期的质询响应。

Answer 1

尝试使用 dns01 质询而不是 HTTP-01

Answer 2

确保您的 POD 在主页 URL 或您在 ingress 主机

上配置的域的主页上返回某些内容

如果HTTP-01无法正常工作，您也可以使用DNS-01方法进行验证

此处为 DNS-01 的示例：

通配符 证书 cert-manager 示例

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: test123@gmail.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - selector:
        dnsZones:
          - "devops.example.in"
      dns01:
        route53:
          region: us-east-1
          hostedZoneID: Z0152EXAMPLE
          accessKeyID: AKIA5EXAMPLE
          secretAccessKeySecretRef:
            name: route53-secret
            key: secret-access-key
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef: 
    kind: Issuer
    name: letsencrypt-prod
  commonName: "*.devops.example.in"
  dnsNames:
    - "*.devops.example.in"

证书管理器挑战待定

cert-manager challenges are pending

ssl

kubernetes

lets-encrypt

cert-manager