Search code examples
sslkubernetestls1.2cert-manager

Emtpy "ca.crt" file from cert-manager

I use cert-manager to generate TLS certificates for my application on Kubernetes with Let's Encrypt.

It is running and I can see "ca.crt", "tls.crt" and "tsl.key" inside the container of my application (in /etc/letsencrypt/).

But "ca.crt" is empty, and the application complains about it (Error: Unable to load CA certificates. Check cafile "/etc/letsencrypt/ca.crt"). The two other files look like normal certificates.

What does that mean?

Solution

  • I noticed this:

    $ kubectl describe certificate iot-mysmartliving -n mqtt
...
Status:
  Conditions:
    ...
    Message:  Certificate issuance in progress. Temporary certificate issued.

    and a related line in the docs:

    https://docs.cert-manager.io/en/latest/tasks/issuing-certificates/index.html?highlight=gce#temporary-certificates-whilst-issuing

    They explain that the two existing certificates are generated for some compatibility, but they are not valid until the issuer has done its work.

    So that suggests that the issuer is not properly set up.

    Edit: yes it was. The DNS challenge was failing, the debug line that helped was

    kubectl describe challenge --all-namespaces=true

    More generally, 

    kubectl describe clusterissuer,certificate,order,challenge --all-namespaces=true