kubernetes tls_error ai_generated true

cert-manager: Waiting for HTTP-01 challenge propagation: wrong status code '404'

ID: kubernetes/k8s-cert-manager-challenge-failed

Also available as: JSON · Markdown
82%Fix Rate
85%Confidence
55Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
8 active — — —

Root Cause

cert-manager ACME challenge (HTTP-01 or DNS-01) fails because the challenge solver can't serve the token or DNS records aren't propagating.

generic

Workarounds

  1. 88% success For HTTP-01: ensure the Ingress routes /.well-known/acme-challenge/* to the cert-manager solver pod 
    Check that the solver Service and Ingress are created: kubectl get challenges -A and kubectl describe challenge <name>

    Sources: https://cert-manager.io/docs/troubleshooting/acme/

  2. 85% success For DNS-01: verify the DNS provider credentials and check if TXT records are created 
    kubectl describe challenge <name> to check the DNS provider error, verify IAM/API credentials for Route53/CloudDNS

    Sources: https://cert-manager.io/docs/configuration/acme/dns01/

Dead Ends

Common approaches that don't work:

  1. Manually create the TLS secret instead of using cert-manager 70% fail

    Certificate won't auto-renew — will expire and cause outages

  2. Delete the Certificate and Order resources and recreate them 75% fail

    If the underlying issue (DNS, ingress routing) isn't fixed, the new challenge will also fail

Error Chain

Leads to:
Preceded by:
Frequently confused with: