ssl - Let's Encrypt 证书颁发-6ren

ssl - Let's Encrypt 证书颁发

转载作者：行者123 更新时间：2023-12-02 11:32:34

我正在尝试获取 Let's Encrypt 颁发的证书，已经过了 3 个半小时。

我最初不小心将我的 secretName 设置为“echo-tls”，然后再将其切换为我想要使用的正确“pandaist-tls”。

我目前有这个:

kubectl get CertificateRequest -o wide
NAME                      READY   ISSUER             STATUS                                                                                             AGE
pandaist-tls-1926992011   False   letsencrypt-prod   Waiting on certificate issuance from order default/pandaist-tls-1926992011-2163900139: "pending"   3h26m

当我描述证书时，我得到了这个:

Deployment kubectl describe CertificateRequest pandaist-tls-1926992011
Name:         pandaist-tls-1926992011
Namespace:    default
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: pandaist-tls
              cert-manager.io/private-key-secret-name: pandaist-tls
API Version:  cert-manager.io/v1alpha2
Kind:         CertificateRequest
Metadata:
  Creation Timestamp:  2020-04-07T15:41:13Z
  Generation:          1
  Owner References:
    API Version:           cert-manager.io/v1alpha2
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Certificate
    Name:                  pandaist-tls
    UID:                   25c3ff31-447f-4abf-a23e-ec48f5a591a9
  Resource Version:        500795
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/default/certificaterequests/pandaist-tls-1926992011
  UID:                     8295836d-fb99-4ebf-8803-a344d6edb574
Spec:
  Csr:  ABUNCHOFVALUESTHATIWILLNOTDESCRIBE
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   ClusterIssuer
    Name:   letsencrypt-prod
Status:
  Conditions:
    Last Transition Time:  2020-04-07T15:41:13Z
    Message:               Waiting on certificate issuance from order default/pandaist-tls-1926992011-2163900139: "pending"
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:                    <none>

然后我查看我的 cert-manager pod 的日志——这里是每个的小片段:

I0407 19:01:35.499469       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-2fp58" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:01:35.499513       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="auth.pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-xhjsr" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:01:35.499534       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-pd9fh" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:01:35.499578       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="auth.pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-b6zr2" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
E0407 19:03:46.571074       1 sync.go:184] cert-manager/controller/challenges "msg"="propagation check failed" "error"="failed to perform self check GET request 'http://pandaist.com/.well-known/acme-challenge/6Wduj2Ejr59OZ9SFy_Rw4jnozE50xspK-a5OIvCwYsc': Get http://pandaist.com/.well-known/acme-challenge/6Wduj2Ejr59OZ9SFy_Rw4jnozE50xspK-a5OIvCwYsc: dial tcp 178.128.132.218:80: connect: connection timed out" "dnsName"="pandaist.com" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
E0407 19:03:46.571109       1 sync.go:184] cert-manager/controller/challenges "msg"="propagation check failed" "error"="failed to perform self check GET request 'http://auth.pandaist.com/.well-known/acme-challenge/gO91--fK0SGG15aS3ALOHXXYtCSly2Q9pbVO8OJW2aE': Get http://auth.pandaist.com/.well-known/acme-challenge/gO91--fK0SGG15aS3ALOHXXYtCSly2Q9pbVO8OJW2aE: dial tcp 178.128.132.218:80: connect: connection timed out" "dnsName"="auth.pandaist.com" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.571382       1 controller.go:135] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="default/pandaist-tls-1926992011-2163900139-832917849" 
I0407 19:03:46.571528       1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="default/pandaist-tls-1926992011-2163900139-832917849" 
I0407 19:03:46.571193       1 controller.go:135] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="default/pandaist-tls-1926992011-2163900139-2157075729" 
I0407 19:03:46.572009       1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="default/pandaist-tls-1926992011-2163900139-2157075729" 
I0407 19:03:46.572338       1 pod.go:58] cert-manager/controller/challenges/http01/selfCheck/http01/ensurePod "level"=0 "msg"="found one existing HTTP01 solver pod" "dnsName"="auth.pandaist.com" "related_resource_kind"="Pod" "related_resource_name"="cm-acme-http-solver-scqtx" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.572600       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="auth.pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-xhjsr" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.572860       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="auth.pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-b6zr2" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.573128       1 pod.go:58] cert-manager/controller/challenges/http01/selfCheck/http01/ensurePod "level"=0 "msg"="found one existing HTTP01 solver pod" "dnsName"="pandaist.com" "related_resource_kind"="Pod" "related_resource_name"="cm-acme-http-solver-jn65v" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.573433       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-2fp58" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.573749       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-pd9fh" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01"

然后在这里，我仍然看到 echo-tls，尽管我将入口更改为使用 pandaist-tls:

I0407 15:34:37.115159       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="validatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
I0407 15:34:37.118246       1 controller.go:170] cert-manager/inject-controller "level"=1 "msg"="updated object" "resource_kind"="ValidatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" 
I0407 15:34:37.118520       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="validatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
I0407 15:34:37.119415       1 sources.go:176] cert-manager/inject-controller "level"=0 "msg"="Extracting CA from Secret resource" "resource_kind"="ValidatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" "secret"="cert-manager/cert-manager-webhook-tls"
I0407 15:34:37.120959       1 controller.go:170] cert-manager/inject-controller "level"=1 "msg"="updated object" "resource_kind"="MutatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" 
I0407 15:34:37.121399       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="mutatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
I0407 15:34:37.124545       1 controller.go:170] cert-manager/inject-controller "level"=1 "msg"="updated object" "resource_kind"="ValidatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" 
I0407 15:34:37.125160       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="validatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
E0407 16:19:36.762436       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"} 
E0407 16:19:36.762573       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"} 
E0407 16:19:36.762753       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"} 
E0407 16:19:36.762766       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"}

我的入口:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: pandaist-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - pandaist.com
    - auth.pandaist.com
    secretName: pandaist-tls
  rules:
  - host: pandaist.com
    http:
      paths:
      - backend:
          serviceName: pandaist-main
          servicePort: 80
  - host: auth.pandaist.com
    http:
      paths:
      - backend:
          serviceName: pandaist-keycloak
          servicePort: 80

这个入口绝对是在 echo one 之后应用的。

这只是正常的证书批准时间(3.5 小时)还是意外包含 echo-tls 弄乱了我的证书颁发？如果是这样，我该如何解决？

最佳答案

由于负载均衡器在 Digital Ocean 上的工作方式存在错误:

https://www.digitalocean.com/community/questions/how-do-i-correct-a-connection-timed-out-error-during-http-01-challenge-propagation-with-cert-manager

这将解决问题:

kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  annotations: 
    # See https://github.com/digitalocean/digitalocean-cloud-controller-manager/blob/master/docs/controllers/services/examples/README.md#accessing-pods-over-a-managed-load-balancer-from-inside-the-cluster
    service.beta.kubernetes.io/do-loadbalancer-hostname: "kube.mydomain.com"
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https

关于ssl - Let's Encrypt 证书颁发，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/61087737/

文章推荐： Kubernetes Alpha 调试命令

文章推荐： asp.net - UserControl 没有名为 ContentTemplate 的公共(public)属性

文章推荐： firefox - 如何在 Greasemonkey 4 中创建新脚本？

文章推荐： kubernetes - 在 istio 中更改 kiali 的 secret 不起作用

java - s = s + s 和 s += s 之间的区别
这个问题在这里已经有了答案: Why don't Java's +=, -=, *=, /= compound assignment operators require casting? (11 个
c# - ORA-21500 : internal error code, 参数 : [%s], [%s]、[%s]、[%s]、[%s]、[%s]、[%s]、[%s]
我搜索了很多，但没有一个链接能帮助我解决这个问题。我得到了 ORA-21500: internal error code, arguments: [%s], [%s], [%s], [%s], [%s
regex - 正则表达式中的 `(\S.*\S)` 和 `^\s*(.*)\s*$` 有什么区别？
我正在做 RegexOne 正则表达式教程，它有一个 question关于编写正则表达式以删除不必要的空格。教程中提供的解决方案是 We can just skip all the starting
javascript - |\s 的目的/作用是什么？在 ([\s\S]+|\s?)
([\s\S]+|\s?) 中 |\s? 的目的或作用是什么？如果没有它，表达式会不会与 ([\s\S]+) 相同？最佳答案这不是完全相同的。 ([\s\S]+|\s?) 会匹配空字符串，而 ([
java - 这个正则表达式有一组还是两组？ "^\\s*(.*?)\\s+-\\s+' (.* )'\\s*$"
这个正则表达式有一组还是两组？我正在尝试使用第二组访问 bookTitle 但出现错误: Pattern pattern = Pattern.compile("^\\s*(.*?)\\s+-\\s+
c - 这个迭代如何工作 : for(++s ; *s;++s)
在 C 中给定一个字符串指针 s，下面的迭代会做什么？即它以什么方式遍历字符串？ for (++s ; *s; ++s); 最佳答案 for (++s ; *s;++s) 表示将指针 s 递增到字符
javascript - 正则表达式 '\s+-\s*|\s*-\s+' 无法正常工作
我正在用一个 node.js 应用程序解析一个大列表并有这段代码 sizeCode = dbfr.CN_DESC.split('\s+-\s*|\s*-\s+') 这似乎不起作用，因为它返回了 [ '
c - 查找字符串结尾 : *s++ VS *s then s++
我正在编写一个简单的字符串连接程序。该程序按照我发布的方式运行。但是，我首先使用以下代码编写它来查找字符串的结尾: while (*s++) ; 但是，这个方法并没有奏效。我传递给它的字符串
java - 正则表达式 (?<=[\\S])[\\S]*\\s* 的作用是什么？
这个问题已经有答案了: What does (?和aramchand来自Mohandas Karamchand G 因此，在使用这些匹配来分割字符串后，您最终会得到 {"M", "K", "G"} 注
java - 映射到列表
~~我正在尝试转换 Map到 List使用 lambda。本质上，我想将键和值与 '=' 连接起来之间。这看起来微不足道，但我找不到如何去做。例如 Map map = new HashMap<>();~~

C 指针 : difference between while(*s++) { ;} and while(*s) { s++;}
我正在经历 K & R，并且在递增指针时遇到困难。练习 5.3(第 107 页)要求您使用指针编写一个 strcat 函数。在伪代码中，该函数执行以下操作: 将 2 个字符串作为输入。找到字符串

c++ - 在 S s = S() 中是否保证不会创建临时文件？
在下面的代码中，pS 和 s.pS 在最后一行是否保证相等？也就是说，在语句S s = S();中，是否可以确定不会构造一个临时的S？ #include using namespace std; s

c# - 关于将类型 'int' 隐式转换为 'char' ，为什么 `s[i] += s[j]` 和 `s[i] = s[i]+s[j] ` 不同
演示示例代码: public void ReverseString(char[] s) { for(int i = 0, j = s.Length-1; i < j; i++, j--){

PowerShell New-TimeSpan 友好地显示为天(s)小时(s)分钟(s)秒(s)
我一直在寻找类似于 .NET examples 中的示例的 PowerShell 脚本.取一个 New-TimeSpan 并显示为 1 天 2 小时 3 分钟 4 秒。排除其零的地方，在需要的地方添加

python - 对于 string_list : s = func(s) can't change string s 中的 s
def func(s): s = s + " is corrected" return s string_list = ["She", "He"] for s in string_li

python - 折叠和 (lambda s : "". join(s.split())) 或 (lambda s: s)
我是 python 的新手。当我在互联网上搜索 lambda 时。我在 lambda_functions 中找到了这个声明. processFunc = collapse and (lambda s:

regex - 如何为包含 "a"s、 "b"s 和 "c"s 但不超过 2 "b"s 和 3 "c"s 的所有字符串编写简洁的正则表达式
我最近开始学习正则表达式，并试图为上面的问题写一个正则表达式。如果限制只放在一个字母上(例如不超过 2 个“b”)，这并不困难。那么答案就是:a* c*(b|ε)a* c*(b|ε)a* c* 但是

python - npm 安装错误导入系统；打印 "%s.%s.%s"
当我运行 npm install 时出现以下错误，但我无法修复它。我试过:npm install -g windows-build-tools 也没有修复这个错误 ERR! configure

haskell - 在 Haskell 中将 "->"s 替换为 "→"s，将 "=>"s 替换为 "⇒"s 等等
有很多有趣的haskell网上可以找到片段。 This post可以在 this (awesome) Stack Overflow question 下找到. The author写道: discou

regex - 在Perl中，s/^\s +//和s/\s + $//有什么区别？
我知道以下三行代码旨在将字符串提取到$ value中并将其存储在$ header中。但是我不知道$value =~ s/^\s+//;和$value =~ s/\s+$//;之间有什么区别。 $val

行者123

个人简介
我是一名优秀的程序员,十分优秀！

作者热门文章

html - 出于某种原因，IE8 对我的 Sass 文件中继承的 html5 CSS 不友好？

JMeter 在响应断言中使用 span 标签的问题

html - 在 :hover and :active? 上具有不同效果的 CSS 动画

html - 相对于居中的 html 内容固定的 CSS 重复背景？

滴滴打车优惠券免费领取

全站热门文章

.NET9使用Scalar替代Swagger

.NET9发布性能提升、AI支持与全方位改进

Java灵魂拷问13个为什么，你都会哪些？

Spring-Event入门实践及执行原理

[这可能是最好的Spring教程！]Maven的模块管理——如何拆分大项目并且用parent继承保证代码的简介性

不当愣头青、聊聊软件架构中的那些惯用的保命手段

SAM4MLLM：结合多模态大型语言模型和SAM实现高精度引用表达分割|ECCV'24

Ubuntu22.04LTS离线安装Harborv2.11(附https认证，Trivy镜像扫描)

太强了！14.7Kstar！Windows系统居然还有开源替代版了？！

使用wxpython开发跨平台桌面应用，对WebAPI调用接口的封装

首页

博学

6Ren·AI

商城

ssl - Let's Encrypt 证书颁发