---
id: 6aa84a21-cb25-41e2-ba62-28d613983b5b
---

# Certificate Generation Issue with Cert-Manager Deployment on Kubernetes.
---

This incident type involves an issue with generating certificates using the cert-manager deployment on Kubernetes. The incident description outlines steps for troubleshooting the issue, including checking the certificate resource, ingress annotations, and issuer state. ACME troubleshooting may also be required.

### Parameters
```shell
export CERTIFICATE_NAME="PLACEHOLDER"

export CERTIFICATE_REQUEST_NAME="PLACEHOLDER"

export ISSUER_NAME="PLACEHOLDER"

export CLUSTER_ISSUER_NAME="PLACEHOLDER"

export CERT_MANAGER_POD_NAME="PLACEHOLDER"

export NAMESPACE="PLACEHOLDER"

export INGRESS_RESOURCE_NAMESPACE_NAME="PLACEHOLDER"

export INGRESS_NAME="PLACEHOLDER"
```

## Debug

### Next Step
```shell
shell

# Check if the necessary certificate resource is present

kubectl get certificates ${CERTIFICATE_NAME}
```

### Check the ingress annotations of the certificate
```shell
kubectl describe certificate ${CERTIFICATE_NAME}
```

### Describe the certificate to check for any errors
```shell
kubectl describe certificate ${CERTIFICATE_NAME}
```

### Check the CertificateRequest to ensure it was properly created
```shell
kubectl get certificaterequest ${CERTIFICATE_REQUEST_NAME}
```

### Check the status of the issuer
```shell
kubectl describe issuer ${ISSUER_NAME}

kubectl describe clusterissuer ${CLUSTER_ISSUER_NAME}
```

### Check the logs of the cert-manager pod for ACME errors
```shell
kubectl logs ${CERT_MANAGER_POD_NAME} -n ${NAMESPACE}
```

### Check the Certificate resource to ensure that it exists and is properly configured.
```shell


#!/bin/bash



# Set the name of the certificate resource

CERT_NAME=${CERTIFICATE_NAME}



# Check if the certificate resource exists

if kubectl get certificate $CERT_NAME >/dev/null 2>&1; then

    echo "Certificate resource $CERT_NAME exists."

else

    echo "Certificate resource $CERT_NAME does not exist."

fi



# Check the configuration of the certificate resource

kubectl describe certificate $CERT_NAME


```

### Check the issuer state by describing the issuer or clusterissuer using kubectl command and verifying that it is in a ready state.
```shell


#!/bin/bash



# Set the ${ISSUER_NAME} or ${CLUSTER_ISSUER_NAME} 

ISSUER_NAME=${ISSUER_NAME}



# Describe the issuer or clusterissuer and check its status

kubectl describe issuer "${ISSUER_NAME}" || kubectl describe clusterissuer "${ISSUER_NAME}"


```

### Verify the ingress annotations to ensure that they are set to true
```shell


#!/bin/bash



# Define variables

NAMESPACE=${INGRESS_RESOURCE_NAMESPACE_NAME}

INGRESS_NAME=${INGRESS_NAME}

CERT_NAME=${CERTIFICATE_NAME}



# Verify ingress annotations

annotations=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.metadata.annotations}')

if [[ $annotations =~ "nginx.ingress.kubernetes.io/ssl-redirect: \"true\"" ]] && [[ $annotations =~ "cert-manager.io/issuer: \"letsencrypt-prod\"" ]] && [[ $annotations =~ "cert-manager.io/cluster-issuer: \"letsencrypt-prod\"" ]] && [[ $annotations =~ "cert-manager.io/issuer-kind: \"Issuer\"" ]] && [[ $annotations =~ "cert-manager.io/issuer-group: \"cert-manager.io\"" ]]

then

    echo "Ingress annotations are properly set."

else

    echo "Ingress annotations are not properly set. Updating annotations..."

    kubectl annotate ingress $INGRESS_NAME -n $NAMESPACE nginx.ingress.kubernetes.io/ssl-redirect="true" cert-manager.io/issuer="letsencrypt-prod" cert-manager.io/cluster-issuer="letsencrypt-prod" cert-manager.io/issuer-kind="Issuer" cert-manager.io/issuer-group="cert-manager.io"

    echo "Annotations updated successfully."

fi






```


This incident type involves an issue with generating certificates using the cert-manager deployment on Kubernetes. The incident description outlines steps for troubleshooting the issue, including checking the certificate resource, ingress annotations, and issuer state. ACME troubleshooting may also be required.


```shell
export CERTIFICATE_NAME="PLACEHOLDER"

export CERTIFICATE_REQUEST_NAME="PLACEHOLDER"

export ISSUER_NAME="PLACEHOLDER"

export CLUSTER_ISSUER_NAME="PLACEHOLDER"

export CERT_MANAGER_POD_NAME="PLACEHOLDER"

export NAMESPACE="PLACEHOLDER"

export INGRESS_RESOURCE_NAMESPACE_NAME="PLACEHOLDER"

export INGRESS_NAME="PLACEHOLDER"
```


### Next Step

```shell
shell

# Check if the necessary certificate resource is present

kubectl get certificates ${CERTIFICATE_NAME}
```

### Check the ingress annotations of the certificate

```shell
kubectl describe certificate ${CERTIFICATE_NAME}
```

### Describe the certificate to check for any errors

```shell
kubectl describe certificate ${CERTIFICATE_NAME}
```

### Check the CertificateRequest to ensure it was properly created

```shell
kubectl get certificaterequest ${CERTIFICATE_REQUEST_NAME}
```

### Check the status of the issuer

```shell
kubectl describe issuer ${ISSUER_NAME}

kubectl describe clusterissuer ${CLUSTER_ISSUER_NAME}
```

### Check the logs of the cert-manager pod for ACME errors

```shell
kubectl logs ${CERT_MANAGER_POD_NAME} -n ${NAMESPACE}
```

### Check the Certificate resource to ensure that it exists and is properly configured.

```shell


#!/bin/bash



# Set the name of the certificate resource

CERT_NAME=${CERTIFICATE_NAME}



# Check if the certificate resource exists

if kubectl get certificate $CERT_NAME >/dev/null 2>&1; then

    echo "Certificate resource $CERT_NAME exists."

else

    echo "Certificate resource $CERT_NAME does not exist."

fi



# Check the configuration of the certificate resource

kubectl describe certificate $CERT_NAME


```

### Check the issuer state by describing the issuer or clusterissuer using kubectl command and verifying that it is in a ready state.

```shell


#!/bin/bash



# Set the ${ISSUER_NAME} or ${CLUSTER_ISSUER_NAME} 

ISSUER_NAME=${ISSUER_NAME}



# Describe the issuer or clusterissuer and check its status

kubectl describe issuer "${ISSUER_NAME}" || kubectl describe clusterissuer "${ISSUER_NAME}"


```

### Verify the ingress annotations to ensure that they are set to true

```shell


#!/bin/bash



# Define variables

NAMESPACE=${INGRESS_RESOURCE_NAMESPACE_NAME}

INGRESS_NAME=${INGRESS_NAME}

CERT_NAME=${CERTIFICATE_NAME}



# Verify ingress annotations

annotations=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.metadata.annotations}')

if [[ $annotations =~ "nginx.ingress.kubernetes.io/ssl-redirect: \"true\"" ]] && [[ $annotations =~ "cert-manager.io/issuer: \"letsencrypt-prod\"" ]] && [[ $annotations =~ "cert-manager.io/cluster-issuer: \"letsencrypt-prod\"" ]] && [[ $annotations =~ "cert-manager.io/issuer-kind: \"Issuer\"" ]] && [[ $annotations =~ "cert-manager.io/issuer-group: \"cert-manager.io\"" ]]

then

    echo "Ingress annotations are properly set."

else

    echo "Ingress annotations are not properly set. Updating annotations..."

    kubectl annotate ingress $INGRESS_NAME -n $NAMESPACE nginx.ingress.kubernetes.io/ssl-redirect="true" cert-manager.io/issuer="letsencrypt-prod" cert-manager.io/cluster-issuer="letsencrypt-prod" cert-manager.io/issuer-kind="Issuer" cert-manager.io/issuer-group="cert-manager.io"

    echo "Annotations updated successfully."

fi






```


Certificate Generation Issue with Cert-Manager Deployment on Kubernetes.

Overview

Parameters

Debug

Next Step

Check the ingress annotations of the certificate

Describe the certificate to check for any errors

Check the CertificateRequest to ensure it was properly created

Check the status of the issuer

Check the logs of the cert-manager pod for ACME errors

Check the Certificate resource to ensure that it exists and is properly configured.

Check the issuer state by describing the issuer or clusterissuer using kubectl command and verifying that it is in a ready state.

Verify the ingress annotations to ensure that they are set to true

Learn more

Related Runbooks

Support