cert-manager HTTP-01挑战失败：未获取预期响应求助

已配置ClusterIssuer、Ingress资源，尝试过单独创建Certificate，也添加了acme.cert-manager.io/http01-edit-in-place: "true"注解，但cert-manager始终报错：HTTP-01挑战传播失败，查询端点未获取到预期token，而是得到法语HTML内容。浏览器访问验证路径可得到预期值，但集群内Pod访问该路径显示域名购买页面，当前挑战处于pending状态。

配置的ClusterIssuer #

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    email: <myemail>
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-cluster-issuer-key
    solvers:
      - http01:
          ingress:
            class: nginx

配置的Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
    kubernetes.io/ingress.class: nginx
  name: web-ingress
  namespace: default
spec:
  rules:
    - host: hostname
      http:
        paths:
          - backend:
              service:
                name: web-service
                port:
                  number: 3000
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - hostname
      secretName: web-cert-tls

单独创建的Certificate #

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: web-cert
  namespace: default
spec:
  dnsNames:
    - hostname.ovh
  secretName: web-cert-tls
  issuerRef:
    name: letsencrypt-cluster-issuer
    kind: ClusterIssuer

cert-manager错误日志 #

E0905 10:09:04.617600       1 sync.go:190] cert-manager/challenges "msg"="propagation check failed" "error"="did not get expected response when querying endpoint, expected \"challengexyzxyz.morestuffherexyzxyz\" but got: <html xml:lang=\"fr-FR\" l... (truncated)" "dnsName"="hostname.ovh" "resource_kind"="Challenge" "resource_name"="web-cert-tls-xtp2r-768063107-2100049723" "resource_namespace"="default" "resource_version"="v1" "type"="HTTP-01"

当前挑战状态 #

Type:         HTTP-01
  URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/12134567898/Fmasf
  Wildcard:     false
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: did not get expected response when querying endpoint, expected "challengexyzxyzxyz-o.challengexyzxyzxyz-o" but got: <html xml:lang="fr-FR" l... (truncated)
  State:       pending

排查解决建议 #

• 检查集群内DNS解析：集群内Pod访问域名跳转到购买页面，说明集群内部DNS解析指向了错误IP（比如域名注册商的默认占位IP）。在集群内运行测试Pod执行nslookup hostname.ovh，确认返回IP与Ingress Controller的外部IP一致。
• 验证临时Ingress配置：cert-manager会自动创建临时Ingress用于HTTP-01挑战，执行kubectl get ingress -n default找到对应挑战的临时Ingress，检查/.well-known/acme-challenge/路径是否正确指向cert-manager的挑战Pod。
• 测试集群内访问链路：在测试Pod中执行curl http://hostname.ovh/.well-known/acme-challenge/[你的挑战token]，查看返回内容是否为预期的挑战值，确认集群内到Ingress Controller的链路是否正常。
• 确认注解位置：确保acme.cert-manager.io/http01-edit-in-place: "true"注解添加到Certificate或对应的Ingress资源上，而非ClusterIssuer。
• 重置挑战资源：删除当前pending的Challenge资源，让cert-manager重新发起挑战：

  kubectl delete challenge web-cert-tls-xtp2r-768063107-2100049723 -n default
  

内容的提问来源于stack exchange，提问作者Adharsh M