← Problem Library
K8s L5 K8S 1378 · 12 min

A cert-manager HTTP01 challenge fails because the temporary solver ingress inherited a global HTTPS redirect annotation and now bounces validation before the solver answers

Issuer and DNS are fine, yet issuance fails because the short-lived solver route inherits a cluster-wide redirect policy.

K8sPlatform ReliabilityLevel 5Pro12 min
Scenario

A global ingress annotation cleanup lands and later only HTTP01 certificate renewals begin to fail.

What to check first
  • Identify the primary failure signal in the The Solver Route Borrowed a Redirect It Could Not Survive scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Inspect the rendered temporary solver ingress before changing DNS, issuers, or account keys.

Questions worth viewing together
What should you verify first when A cert-manager HTTP01 challenge fails appears?

Community-field Kubernetes problem inspired by cert-manager and ingress discussions where a solver ingress inherited an unwanted redirect. Temporary ACME routes can inherit cluster-wide ingress behavior that breaks validation.

What usually causes A cert-manager HTTP01 challenge fails in production?

Teams often blame the CA or DNS when the local ingress is redirecting the challenge away.

What should you document after resolving A cert-manager HTTP01 challenge fails?

Global ingress annotations should be tested against short-lived solver objects and challenge paths.