Ingress nginx cert-manager 证书在浏览器上无效

Question

I am experiencing a rather weird issue and have been stuck on this for 2 days. I have a kubernetes cluster running nginx-ingress and cert-manager. Everything seems to be working fine though when visiting my website through HTTPS, it gives the following error (in chromium edge):

NET::ERR_CERT_AUTHORITY_INVALID

If I continue anyways, it loads the site normally but without the certificate.

The certificate is properly being given, secret created, no errors anywhere.

I have the following annotations in my ingress resource:

    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-production"
    ingress.kubernetes.io/ssl-redirect: "true"

My cluster issuer:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    # The ACME production api URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: *********
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-production
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx

The certificate resource returns:

 Normal  Issuing    108s   cert-manager  The certificate has been successfully issued

I am relatively new to kubernetes so let me know if there are any other debugging steps I can take.

Answer 1

You are using acme staging server: https://acme-staging-v02.api.letsencrypt.org/directory server which does not provide valid certificate. To get valid certificate you have to use acme production server server: https://acme-v02.api.letsencrypt.org/directory . you can try this.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    # The ACME production api URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: *********
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-production
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx