Issuer not found

[koldoon]

Describe the bug:
When I created valid issuer and configured ingress, description for certificate request says "issuer with such a name not found". I tried to put everything in the same names space - no result.

Expected behaviour:
Issuer is found and certificate is created.

Steps to reproduce the bug:
Install new cert-manager using helm:

helm install cert-manager jetstack/cert-manager --version v0.15.0 --set installCRDs=true

Create letsencrypt issuer:

apiVersion: cert-manager.io/v1alpha2
kind: Issuer

metadata:
  name: letsencrypt-prod

spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <emailhere>

    privateKeySecretRef:
      name: letsencrypt-private

    solvers:
      - selector: {}
        http01:
          ingress:
            class: nginx

apply issuer:

kubectl apply -f issuer.yaml

configure ingress:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress

metadata:
  name: app-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/issuer: letsencrypt-prod

spec:
  rules:
    - host: <hostname here>
      http:
        paths:
          - path: /
            backend:
              serviceName: some-service
              servicePort: 80
  tls:
    - secretName: tls-secret
      hosts:
        - <hostname here>

check certificate:

kubectl describe cert

result:
Message: Waiting for CertificateRequest "tls-secret-730493472" to complete

check request:

kubectl describe CertificateRequest tls-secret-730493472

result:
Referenced "Issuer" not found: issuer.cert-manager.io "letsencrypt-prod" not found

but if check issuers:
kubectl get issuer

result is:

NAME               READY   AGE
letsencrypt-prod   True    37m

Environment details::

• Kubernetes version: v1.14.10-gke.36
• Cloud-provider/provisioner: GKE
• cert-manager version: v0.15.0-0.15.2
• Install method: helm

/kind bug

[meyskens]

Assuming you copy pasted the errors I think the issue is a typo here letsenrypt-prod != letsencrypt-prod

/remove-kind bug
/triage support

[koldoon]

Unfortunately, no, I've checked twice. That mistake you've mentioned (letsenrypt-prod != letsencrypt-prod) is a mistake during this bug creation, but on the real environment everything is right. The only workaround i've found is to create Certificate manually and not annotate ingress with cert-manager.io/issuer at all.

[meyskens]

This is weird, do you have a diff of what ingress-shim created vs the certificate resource you created?

[guy-tallon]

I am having the same problem. I can't figure out what's not working.

Shows the issuer as present and "ready" but it's just waiting for the request to complete

kind: Ingress
metadata:
  name: ingress-resource
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/issuer: "letsencrypt-production"
spec:
  tls:
  - hosts:
    - my.domain.com
    secretName: hello-tls
  rules:
  - host: my.domain.com
    http:
      paths:
      - path: /helloworld
        backend:
          serviceName: hello-app
          servicePort: 8080

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: me@mydomain.com
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
    - selector: {}
      http01:
        ingress:
          class: nginx

[meyskens]

@furby https://cert-manager.io/docs/faq/troubleshooting/ might help

[juliantellez]

just came across this issue and the problem was specifying the right kind of issuer in your certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: <name>
spec:
  secretName: <secret>
  issuerRef:
    name: <my-ref>
    kind: <ClusterIssuer | Issuer >
  dnsNames:
  ...

[ghost]

Thanks, this helped me find that my annotation for my ingress object I had cert-manager.io/issuer: "letsencrypt-prod" but I really wanted cert-manager.io/cluster-issuer: "letsencrypt-prod".

[hemeda3]

Thanks for you both, I needed to. check what is my issuer kind (issuer vs ClusterIssuer), based on this I needed to update ingress annotations:

here was my cluster issuer:

apiVersion: cert-manager.io/v1
kind: **ClusterIssuer**
metadata:
  name: letsencrypt-prod
spec:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-echo
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
-----> (this was wrong in **my** case)   cert-manager.io/**issuer**: letsencrypt-prod

should be:

 ----> ( this is the correct in **m**y case)   cert-manager.io/**cluster-issuer**: letsencrypt-prod

[zachrank]

+1 to @ghost and @hemeda3's comments, I've been pulling hair out all afternoon over a simple typo. I've been using a ClusterIssuer but the annotation on my ingress was cert-manager.io/issuer:... rather than cert-manager.io/cluster-issuer:....

[ku3mich]

thanks, same issue

[cunnie]

Also make sure your issuer is in the same namespace. For example, if you're seeing this error when trying to acquire a cert in your vault namespace, it may be because there's no issuer in that namespace, only in the default namespace. From https://cert-manager.io/docs/concepts/issuer/:

An Issuer is a namespaced resource, and it is not possible to issue certificates from an Issuer in a different namespace. This means you will need to create an Issuer in each namespace you wish to obtain Certificates in.

If you want to create a single Issuer that can be consumed in multiple namespaces, you should consider creating a ClusterIssuer resource

[PeterThomasAwen]

Hi Cunnie/All,

I'm having a similar problem when trying to issue a certificate (im using a clusterIssuer) so namespace shouldnt be an issuebut I cannot workout why this is happening?

Normal IssuerNotFound 44m (x5 over 44m) cert-manager Referenced "ClusterIssuer" not found: clusterissuer.cert-manager.io "letsencrypt-production" not found

kubectl get clusterissuers

letsencrypt-production   True    42m
letsencrypt-staging      True    42m```

kubectl describe clusterissuer letsencrypt-production
```Name:         letsencrypt-production
Namespace:    
Labels:       app.kubernetes.io/managed-by=Helm
Annotations:  meta.helm.sh/release-name: cluster-certs
              meta.helm.sh/release-namespace: cert-manager
API Version:  cert-manager.io/v1
Kind:         ClusterIssuer
Spec:
  Acme:
    Email:           x
    Preferred Chain:  
    Private Key Secret Ref:
      Name:  letsencrypt-production
    Server:  https://acme-v02.api.letsencrypt.org/directory
    Solvers:
      dns01:
        Azure DNS:
          Client ID:  84986ca1-c6dc-4c89-9339-3e83cec38e9d
          Client Secret Secret Ref:
            Key:                azure-certmanager-secret-key
            Name:               azure-certmanager-secret
          Environment:          AzurePublicCloud
          Hosted Zone Name:     x
          Resource Group Name: x
          Subscription ID:      x
          Tenant ID:            x
      Selector:
        Dns Zones:
          x
      dns01:
        Azure DNS:
          Client ID:  84986ca1-c6dc-4c89-9339-3e83cec38e9d
          Client Secret Secret Ref:
            Key:                azure-certmanager-secret-key
            Name:               azure-certmanager-secret
          Environment:          AzurePublicCloud
          Hosted Zone Name:     x
          Resource Group Name:  x
          Subscription ID:      x
          Tenant ID:            x
      Selector:
        Dns Zones:
          zone.example.com
Status:
  Acme:
    Last Registered Email:  Email
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/343858610
  Conditions:
    Last Transition Time:  2021-12-31T14:57:36Z
    Message:               The ACME account was registered with the ACME server
    Observed Generation:   1
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                  <none>```

[cunnie]

Hi @PeterThomasAwen : I've never set up a ClusterIssuer, so I'm afraid I can't be of much help here. Good luck!