'cert-manager with ZeroSSL creating multiple orders even if previous orders are ready

I'm using ZeroSSL account to create ACME certificates. I was able to get EAB credentials from ZeroSSL, which I added to the ClusterIssuer.

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: zerossl-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme.zerossl.com/v2/DV90
    externalAccountBinding:
      keyID: keyidFromZeroSSL
      keySecretRef:
        name: zerossl-eabsecret
        key: value
      keyAlgorithm: HS256
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: zerossl-prod
    solvers:
    - dns01:
        route53:
          region: eu-central-1

The issuer is set up in the cluster with success. No issues here.

Next, when I create a CertificateRequest with my CSR, this never gets in Ready state. Even after I can see that certificates have been created at ZeroSSL, I cannot see in cert-manager that CeritificateRequest is ready.

This is in the CertificateRequest:

message: 'Waiting on certificate issuance from order default/mytestcert-4230347456:
      "ready"'
    reason: Pending
    status: "False"
    type: Ready

And this in logs

E0129 09:27:23.134393       1 controller.go:143] cert-manager/controller/certificaterequests-issuer-acme "msg"="re-queuing item  due to error processing" "error"="Operation cannot be fulfilled on certificaterequests.cert-manager.io \"mytestcert\": the object has been modified; please apply your changes to the latest version and try again" "key"="default/mytestcert

I0129 09:27:23.092737       1 sync.go:77] cert-manager/controller/orders "msg"="Creating new ACME order as status.url is not set" "resource_kind"="Order" "resource_name"="mytestcert-4230347456" "resource_namespace"="default"

I0129 09:27:23.092865       1 sync.go:190] cert-manager/controller/orders "msg"="order URL not set, submitting Order to ACME server" "resource_kind"="Order" "resource_name"="mytestcert-4230347456" "resource_namespace"="default"

I was also able to see in Route53 and ACME record was created.

*This is what I see in the order description:

dnsNames:
- subdomain.dev.domain.com
- '*.mytestcert.subdomain.dev.domain.com'
issuerRef:
kind: ClusterIssuer
name: zerossl-prod
status:
  authorizations:
  - challenges:
    - token: Dx6JuVjZvrqOVCt0XnZBA_hZ4b4dsMYWikYdZ7Muovs
      type: dns-01
      url: https://acme.zerossl.com/v2/DV90/chall/FuZk8FkdUBEA3l3sPtcKBw
    identifier: mytestcert.subdomain.dev.domain.com
    initialState: pending
    url: https://acme.zerossl.com/v2/DV90/authz/M-Xy9ZHTMplpBXjvxpcnPg
    wildcard: true
  - challenges:
    - token: JlYucJq9g8JhcR1PbQA-24AMT0jurB0CWmvytcJccn4
      type: http-01
      url: https://acme.zerossl.com/v2/DV90/chall/fJPyzw1G82XM6vsPj4pciw
    - token: 4Q9KKoyMP0FDX-mmJEGmz4xcI3lmEISvo_izFqsk-I0
      type: dns-01
      url: https://acme.zerossl.com/v2/DV90/chall/11o2BonMlGgHnJp65oDIDg
    identifier: subdomain.dev.domain.com
    initialState: pending
    url: https://acme.zerossl.com/v2/DV90/authz/cPBHkbnLvEqMZYg0A_BJ_Q
    wildcard: false
  finalizeURL: https://acme.zerossl.com/v2/DV90/order/ZoWmwVynu0IQ31CC-jy3BA/finalize
  state: ready
  url: https://acme.zerossl.com/v2/DV90/order/ZoWmwVynu0IQ31CC-jy3BA

*This is when I put a watcher on Challenge

mytestcert-322629104-1271033422   pending   mytestcert.subdomain.dev.domain.com   73s
mytestcert-322629104-2202102765   pending   subdomain.dev.domain.com                    73s
mytestcert-322629104-1271033422   valid     mytestcert.subdomain.dev.domain.com   100s
mytestcert-322629104-2202102765   valid     subdomain.dev.domain.com                    100s
mytestcert-322629104-1271033422   valid     mytestcert.subdomain.dev.domain.com   111s
mytestcert-322629104-2202102765   valid     subdomain.dev.domain.com                    111s
mytestcert-322629104-3344217095             mytestcert.subdomain.dev.domain.com   0s
mytestcert-322629104-2697588659             subdomain.dev.domain.com                    0s
mytestcert-322629104-1271033422   valid     mytestcert.subdomain.dev.domain.com   2m16s
mytestcert-322629104-3344217095             mytestcert.subdomain.dev.domain.com   26s
mytestcert-322629104-2202102765   valid     subdomain.dev.domain.com                    2m17s
mytestcert-322629104-3344217095   pending   mytestcert.subdomain.dev.domain.com   26s
mytestcert-322629104-2697588659             subdomain.dev.domain.com                    27s
mytestcert-322629104-2697588659   pending   subdomain.dev.domain.com                    27s

*This is when I put a watcher on Order:

mytestcert-322629104   pending   79s
mytestcert-322629104   ready     2m8s
mytestcert-322629104   valid     2m18s
mytestcert-322629104   valid     2m18s
mytestcert-322629104             0s
mytestcert-322629104   pending   0s
mytestcert-322629104   pending   0s
mytestcert-322629104   ready     107s
mytestcert-322629104   valid     117s
mytestcert-322629104   valid     117s
mytestcert-322629104             0s
mytestcert-322629104   pending   0s
mytestcert-322629104   pending   0s

In the meanwhile cert-manager tries to generate/retrieve cert, I can see it has created around 4 certs in ZeroSSL. Cert download from ZeroSSL is possible and it looks good.

But I cannot manually download certs from ZeroSSL as I'm relying on my application code to fetch the certs from cert-manager.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source

'cert-manager with ZeroSSL creating multiple orders even if previous orders are ready

Sources

Related Questions