EKS中ClusterIssuer未签发有效证书：cert-manager配置求助

在Amazon EKS集群中使用jetstack/cert-manager为WordPress应用配置HTTPS访问时，浏览器显示“Not Secure”，访问域名出现NET::ERR_CERT_AUTHORITY_INVALID错误。已部署ClusterIssuer、WordPress资源及Ingress，且kubectl describe certificate letsencrypt-production显示证书状态为Ready，但问题依旧。

配置详情 #

ClusterIssuer配置 #

apiVersion: "cert-manager.io/v1"
kind: "ClusterIssuer"
metadata:
  name: "letsencrypt-production"
spec:
  acme:
    server: "https://acme-v02.api.letsencrypt.org/directory"
    email: "something@gmail.com"
    privateKeySecretRef:
      name: "letsencrypt-production"
    solvers:
      - http01:
          ingress:
            class: "nginx"

WordPress应用资源清单 #

apiVersion: "apps/v1"
kind: "Deployment"
metadata:
  name: "wordpress"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: "wordpress"
  template:
    metadata:
      labels:
        app: "wordpress"
    spec:
      containers:
        - name: "wordpress"
          image: "wordpress:latest"
          ports:
            - containerPort: 80
---
apiVersion: "v1"
kind: "Service"
metadata:
  name: "wordpress"
spec:
  selector:
    app: "wordpress"
  ports:
    - protocol: "TCP"
      port: 80
---
apiVersion: "networking.k8s.io/v1"
kind: "Ingress"
metadata:
  name: "wordpress"
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-production"
spec:
  rules:
    - http:
        paths:
          - path: "/"
            pathType: "Prefix"
            backend:
              service:
                name: "wordpress"
                port:
                  number: 80
  tls:
    - hosts:
      - "mydomain.com"
      secretName: "letsencrypt-production"

证书状态输出 #

Status:
  Conditions:
    Last Transition Time:  2022-12-22T06:04:30Z
    Message:               Certificate is up to date and has not expired
    Observed Generation:   1
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2023-03-21T11:04:22Z
  Not Before:              2022-12-21T11:04:23Z
  Renewal Time:            2023-02-19T11:04:22Z
Events:                    <none>

问题排查与解决方案 #

核心问题：Secret名称冲突 #

你的ClusterIssuer的privateKeySecretRef.name和Ingress的tls.secretName都设置为letsencrypt-production，这会导致冲突：

• ClusterIssuer使用该Secret存储自己的ACME账户私钥
• cert-manager本应生成包含SSL证书的Secret，但因名称重复，Ingress实际加载的是ClusterIssuer的私钥而非有效证书，从而触发证书权威无效错误。

修复步骤 #

1. 修改Ingress的证书Secret名称
   更新Ingress资源的tls.secretName为唯一名称，比如wordpress-tls：

   apiVersion: "networking.k8s.io/v1"
   kind: "Ingress"
   metadata:
     name: "wordpress"
     annotations:
       kubernetes.io/ingress.class: "nginx"
       cert-manager.io/cluster-issuer: "letsencrypt-production"
   spec:
     rules:
       - http:
           paths:
             - path: "/"
               pathType: "Prefix"
               backend:
                 service:
                   name: "wordpress"
                   port:
                     number: 80
     tls:
       - hosts:
         - "mydomain.com"
         secretName: "wordpress-tls"  # 修改此处为新名称
   

   应用更新：kubectl apply -f your-ingress-file.yaml

2. 删除冲突的旧Secret
   删除重复名称的Secret，让cert-manager重新生成正确的证书Secret：

   kubectl delete secret letsencrypt-production
   

3. 验证证书生成状态
   查看新证书的状态，确认其处于Ready状态：

   kubectl describe certificate wordpress-tls
   

   等待几分钟，cert-manager会自动完成ACME挑战并颁发证书。

4. 验证Ingress与证书关联
   检查Ingress事件，确认已成功加载新证书：

   kubectl describe ingress wordpress
   

5. 浏览器端验证
   清除浏览器缓存后重新访问域名，查看证书详情，确认证书颁发机构为Let's Encrypt。

额外检查点 #

• 确认域名mydomain.com已正确解析到EKS集群的Nginx Ingress Controller的公网IP
• 检查Nginx Ingress Controller的Pod日志，确认没有证书加载错误：

  kubectl logs -n kube-system -l app=nginx-ingress
  

内容的提问来源于stack exchange，提问作者user3398900