Ben Vincent
9ed9ebe167
A live smoke test showed cert-manager sending the rfc2136 UPDATE to zone unkin.net (walked from _acme-challenge.unkin.net), which bind-external is not authoritative for, returning NOTAUTH; the solver was not following the delegation CNAME. - Set cnameStrategy: Follow on the letsencrypt and letsencrypt-staging ClusterIssuer DNS-01 solvers so cert-manager chases the _acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net CNAME and updates the acme.unkin.net zone. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
22 lines
539 B
YAML
22 lines
539 B
YAML
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
email: admin@unkin.net
|
|
privateKeySecretRef:
|
|
name: letsencrypt-account-key
|
|
solvers:
|
|
- dns01:
|
|
cnameStrategy: Follow
|
|
rfc2136:
|
|
nameserver: "198.18.199.53:53"
|
|
tsigKeyName: certmanager
|
|
tsigAlgorithm: HMACSHA256
|
|
tsigSecretSecretRef:
|
|
name: certmanager-tsig
|
|
key: secret
|