How do I force a cert renewal after adding new entries to dnsNames?

[williamchong]

I added a new entry in Certificate dnsNames list
but after applying the new yaml, the status is still stuck in Certificate scheduled for renewal in x hours

Is there anyway I can force a renewal of current certificate?

[whereisaaron]

@williamchong007 as desirable feature for cert-manager would be to reconcile Secrets with Certificates and update the Secret if required, kube-cert-managaer has such a reconciliation pass that handles this, and a trigger for update of Certificates, cert-manager could use something similar.

Right now the work-around is probably to delete the Secret and wait for cert-manager to recreate it.
@munnerz will a missing Secret get recreated this way or does @williamchong007 need to update the Certificate, after deleting the Secret to trigger it?

[munnerz]

cert-manager should already do this 🤔 if it doesn't, it's a regression.

[munnerz]

Specifically this line is where we check this case: https://github.com/jetstack/cert-manager/blob/master/pkg/controller/certificates/sync.go#L129

I'll add some tests to this part of the codebase to verify the behaviour is as expected, as it's strange you're seeing this.

/kind bug

[munnerz]

I'm going to write a test case for this that'll modify a certificate after it has been issued to add a new dnsName. Hopefully that will show definitively whether this does work.. 😄

[cyberaleks]

Same problem. Is there any workaround?
After update of ingress hosts, i get the following logs:

Type Reason Age From Message

---

Normal RenewalScheduled 7m cert-manager-controller Certificate scheduled for renewal in 1406 hours

[rot26]

same issue.

I tried deleting the secret, but cert-manager says

I0220 20:38:24.127155       1 sync.go:107] Error checking existing TLS certificate: secret "tls-secret" not found

When I re-add the deleted secret, I get the same as @cyberaleks

I0220 20:53:26.250255       1 sync.go:200] Certificate scheduled for renewal in 1430 hours

I tried using cert-manager command to refresh the cert, but I get:

I0220 20:45:28.060107      43 leaderelection.go:199] successfully renewed lease kube-system/cert-manager-controller
I0220 20:45:29.967466      43 http.go:410] ACME HTTP01 self check failed for domain "secret.com", waiting 5s: wrong status code '403'

I did have this working before I added subdomains, so i am pretty sure the new subdomains is what broke it.

@munnerz is there a possible workaround to exec a cert-manager command to force a cert reissue inside the cert-mangaer pod before this fix is fully ready?
Thanks.

[boogie4eva]

I had the same issue has anyone figured this out yet ?

[euank]

Error checking existing TLS certificate: secret "tls-secret" not found

That's not an actual error, that message occurs during normal operation. Per the 'I' in the leftmost column, it is an info message, not warning or error.

I had the same issue has anyone figured this out yet ?

Adding an entry to my certificate works fine for me and it immediately renews.

In the detail fold below are the steps I followed to test this. If someone can give similar steps showing it not working, I think that would be helpful for figuring out what's going wrong.

Regardless, I think more information is necessary since naively trying to do this works fine for me, so there must be something different.

Details

$  kubectl version
Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.7", GitCommit:"b30876a5539f09684ff9fde266fda10b37738c9c", GitTreeState:"clean", BuildDate:"2018-01-16T21:59:57Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.6", GitCommit:"6260bb08c46c31eea6cb538b34a9ceb3e406689c", GitTreeState:"clean", BuildDate:"2017-12-21T06:23:29Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

$ kubectl -n kube-system describe deployment cert-manager | grep Image
    Image:  quay.io/jetstack/cert-manager-controller:v0.2.3

$ cat test.euank-cert.yaml 
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: test-88-euank-crt
spec:
  secretName: test-88-euank-com
  commonName: test-88.euank.com
  acme:
    config:
    - dns01:
        provider: route53-provider
      domains:
      - test-88.euank.com
  issuerRef:
    name: letsencrypt
    kind: Issuer

$ kubectl apply -f test.euank-cert.yaml
certificate "test-88-euank-crt" created
# wait for it to issue a cert
$ kubectl describe certificate test-88-euank-crt
... (omitted for brevity)
  Common Name:  test-88.euank.com
  Dns Names:    <nil>
... (omitted for brevity)
Events:
  Type    Reason               Age              From                     Message
  ----    ------               ----             ----                     -------
  Normal  PrepareCertificate   2m               cert-manager-controller  Preparing certificate with issuer
  Normal  PresentChallenge     2m               cert-manager-controller  Presenting dns-01 challenge for domain test-88.euank.com
  Normal  SelfCheck            1m               cert-manager-controller  Performing self-check for domain test-88.euank.com
  Normal  ObtainAuthorization  53s              cert-manager-controller  Obtained authorization for domain test-88.euank.com
  Normal  IssueCertificate     3s               cert-manager-controller  Issuing certificate...
  Normal  CeritifcateIssued    3s               cert-manager-controller  Certificated issued successfully
  Normal  RenewalScheduled     3s (x2 over 3s)  cert-manager-controller  Certificate scheduled for renewal in 1438 hours

$ kubectl get secret test-88-euank-com -o json | jq '.data["tls.crt"]' -r | base64 -d | openssl x509 -noout -text | grep "euank.com"                                                                                                                           
        Subject: CN = test-88.euank.com
                DNS:test-88.euank.com

$ cat test-more-domains.euank-cert.yaml 
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: test-88-euank-crt
spec:
  secretName: test-88-euank-com
  commonName: test-88.euank.com
  dnsNames:
  - test-89.euank.com
  - test-90.euank.com
  acme:
    config:
    - dns01:
        provider: route53-provider
      domains:
      - test-88.euank.com
      - test-89.euank.com
      - test-90.euank.com
  issuerRef:
    name: letsencrypt
    kind: Issuer

$ kubectl apply -f test-more-domains.euank-cert.yaml
certificate "test-88-euank-crt" configured
# wait for it to issue

$ kubectl describe certificate test-88-euank-crt  
...
  Common Name:  test-88.euank.com
  Dns Names:
    test-89.euank.com
    test-90.euank.com
...
Events:
  Type    Reason               Age               From                     Message
  ----    ------               ----              ----                     -------
  Normal  PresentChallenge     8m                cert-manager-controller  Presenting dns-01 challenge for domain test-88.euank.com
  Normal  SelfCheck            8m                cert-manager-controller  Performing self-check for domain test-88.euank.com
  Normal  ObtainAuthorization  7m                cert-manager-controller  Obtained authorization for domain test-88.euank.com
  Normal  PrepareCertificate   2m (x2 over 8m)   cert-manager-controller  Preparing certificate with issuer
  Normal  PresentChallenge     2m                cert-manager-controller  Presenting dns-01 challenge for domain test-89.euank.com
  Normal  PresentChallenge     2m                cert-manager-controller  Presenting dns-01 challenge for domain test-90.euank.com
  Normal  SelfCheck            2m                cert-manager-controller  Performing self-check for domain test-90.euank.com
  Normal  SelfCheck            2m                cert-manager-controller  Performing self-check for domain test-89.euank.com
  Normal  ObtainAuthorization  1m                cert-manager-controller  Obtained authorization for domain test-90.euank.com
  Normal  ObtainAuthorization  1m                cert-manager-controller  Obtained authorization for domain test-89.euank.com
  Normal  IssueCertificate     10s (x2 over 6m)  cert-manager-controller  Issuing certificate...
  Normal  CeritifcateIssued    9s (x2 over 6m)   cert-manager-controller  Certificated issued successfully
  Normal  RenewalScheduled     9s (x4 over 6m)   cert-manager-controller  Certificate scheduled for renewal in 1438 hours


$ kubectl get secret test-88-euank-com -o json | jq '.data["tls.crt"]' -r | base64 -d | openssl x509 -noout -text | grep "euank.com"
        Subject: CN = test-88.euank.com
                DNS:test-88.euank.com, DNS:test-89.euank.com, DNS:test-90.euank.com

[rot26]

euank, thanks for pointing out the "I" character.

I ended up creating new resources under a different name and it worked.

I will see if I can recreate the issue next time I have access to that system.

[peterfication]

I had the same problem. When I changed a domain name in the certificate, nothing happened. But when I added a new one, it worked. So maybe this helps in finding the bug.

[ernoaapa]

I face probably the same issue. Wanted to change the issuer, and did following:

• Updated Ingress to have certmanager.k8s.io/cluster-issuer: "letsencrypt-prod"
• Nothing happened
• Deleted the certificate
• cert-manager created new one
• expected it to update the secret, but did not :(

Deleting the secret is quite bad because then your service goes down for a moment. Overwriting the secret would be preferable.

[Rambatino]

This is now coming up to 2 months old, I see the tests haven't gone in and the PR looks stale (#338): What's the situation with this now?

[munnerz]

@Rambatino I've not had a chance to rebase and follow up that PR, no.

I will try and find some time over the next few days/week to take a look, but it is blocked on #110 (as we don't currently read the dnsNames/CN on the produced Certificate resource). That's what has made #338 more complex to implement 😄