unkinben
4fc4aed358
A live DNS-01 smoke test returned NOTAUTH because the solver walked _acme-challenge.unkin.net to zone unkin.net and sent the rfc2136 UPDATE there, but bind-external is only authoritative for acme.unkin.net; without cnameStrategy: Follow the solver does not chase the delegation CNAME. - Set `cnameStrategy: Follow` on the `letsencrypt` and `letsencrypt-staging` ClusterIssuer DNS-01 solvers so cert-manager follows the `_acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net` CNAME and updates the `acme.unkin.net` zone. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #331 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
22 lines
539 B
YAML
22 lines
539 B
YAML
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
email: admin@unkin.net
|
|
privateKeySecretRef:
|
|
name: letsencrypt-account-key
|
|
solvers:
|
|
- dns01:
|
|
cnameStrategy: Follow
|
|
rfc2136:
|
|
nameserver: "198.18.199.53:53"
|
|
tsigKeyName: certmanager
|
|
tsigAlgorithm: HMACSHA256
|
|
tsigSecretSecretRef:
|
|
name: certmanager-tsig
|
|
key: secret
|