there were too many requests of a given type letsencrypt

(unless you use /http01-edit-in-place, then check the same ingress as your domain)

use kubectl describe ingress to check the status of the HTTP01 solver ingress.

you can access the URL from the public internet.

If your challenge self-check fails with a 404 not found error. This will allow the Google Cloud Loadbalancer to propagate a HTTPS endpoint correctly with a temporary certificate, the http01-edit-in-place part will prevent GKE from assigning a 2nd IP address for the challenge endpoint.

If you still are having issues, there may be an issue with your ingress controller handling multiple resources for the same hostname, in this case, the annotation /http01-edit-in-place: 'true' is likely required.įor example when using GKE with the Google Cloud Loadbalancer it is recommended to set:Ī/http01-edit-in-place: 'true' This will issue a temporary self signed certificate for the ingress controller to use before the actual certificate is issued. If you receive a tls: handshake failure, try setting the annotation cert-manager.io/issue-temporary-certificate: 'true' on the Ingress or Certificate resource. If you get a connection error it is suggested to check the cluster's network configuration. It is important to test this from inside a Pod. If this does work check if your cluster can see it too.

HTTP01 troubleshootingįirst of all check if you can see the challenge URL from the public internet, if this does not work check your Ingress and firewall configuration as well as the service and pod cert-manager created to solve the ACME challenge. You will also see any errors coming from your DNS provider here. In this example our HTTP01 check fails due a network issue.

There were too many requests of a given type letsencrypt