---
# System prepended metadata

title: Testing TLS with a custom domain and ACME Let’s Encrypt

---

# Testing TLS with a custom domain and ACME Let’s Encrypt

My domain is managed on Linode, so I’m using the [Linode webhook](https://github.com/slicen/cert-manager-webhook-linode) as a DNS01 provider as described in the [cert-manager docs](https://cert-manager.io/docs/configuration/acme/dns01/webhook/).

1. Create an API token in Linode with permission to read/write to domains.
    ![](https://i.imgur.com/zd7lvsH.png)


1. Create the secret to hold the Linode API token

    ```bash
    kubectl create secret generic linode-credentials \
    --namespace=cert-manager \
    --from-literal=token=
    ```

    By default, the ClusterIssuer will obtain the Linode API token from the linode-credentials Secret in the same namespace as the webhook (cert-manager)
    
1. Create the same secret in the redpanda namespace so that the Certificate can also reach it.

    ```bash
    kubectl create secret generic linode-credentials \
    --namespace=redpanda \
    --from-literal=token=
    ```
    
1. Create the ClusterIssuer.

    ```yaml
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: letsencrypt-staging
    spec:
      acme:
        server: https://acme-staging-v02.api.letsencrypt.org/directory
        email: jakecahill91@gmail.com
        privateKeySecretRef:
          name: letsencrypt-staging
        solvers:
        - dns01:
            webhook:
              solverName: linode
              groupName: acme.slicen.me
    ```
    
1. Install Redpanda
    
    ```bash
    helm upgrade --install redpanda ./charts/redpanda \
    -n redpanda --create-namespace \
    --set tls.enabled=true \
    --set external.domain=adnapder1.com \
    --set storage.persistentVolume.enabled=false \
    --set tls.certs.redpanda.issuerRef.name=letsencrypt-prod \
    --set tls.certs.redpanda.issuerRef.kind=ClusterIssuer \
    --set tls.certs.redpanda.caEnabled=false
    ```
    
The install fails because the post-install timed out. This is the result of describing that job:
    
Result:

```
Events:
  Type     Reason       Age                  From               Message
  ----     ------       ----                 ----               -------
  Normal   Scheduled    5m44s                default-scheduler  Successfully assigned redpanda/redpanda-post-install-xs6kx to worker3
  Warning  FailedMount  5m43s                kubelet            MountVolume.SetUp failed for volume "redpanda-redpanda-cert" : failed to sync secret cache: timed out waiting for the condition
  Warning  FailedMount  3m41s                kubelet            Unable to attach or mount volumes: unmounted volumes=[redpanda-redpanda-cert], unattached volumes=[redpanda config redpanda-redpanda-cert kube-api-access-cbwdt]: timed out waiting for the condition
  Warning  FailedMount  93s (x9 over 5m43s)  kubelet            MountVolume.SetUp failed for volume "redpanda-redpanda-cert" : secret "redpanda-redpanda-cert" not found
  Warning  FailedMount  86s                  kubelet            Unable to attach or mount volumes: unmounted volumes=[redpanda-redpanda-cert], unattached volumes=[config redpanda-redpanda-cert kube-api-access-cbwdt redpanda]: timed out waiting for the condition
```

```
ubuntu@master:~$ kubectl get certificaterequest -n redpanda
NAME                                       APPROVED   DENIED   READY   ISSUER                                REQUESTOR                                         AGE
redpanda-redpanda-cert-c7nmd               True                False   letsencrypt-staging                   system:serviceaccount:cert-manager:cert-manager   7m37s
redpanda-redpanda-root-certificate-6x5h5   True                False   redpanda-redpanda-selfsigned-issuer   system:serviceaccount:cert-manager:cert-manager   7m37s
redpanda-vlg6h                             True                False   letsencrypt-staging                   system:serviceaccount:cert-manager:cert-manager   8m13s
```

```
ubuntu@master:~$ kubectl describe certificaterequest redpanda-redpanda-cert-c7nmd -n redpanda
```

```
    Message:               The CSR PEM requests a commonName that is not present in the list of dnsNames or ipAddresses. If a commonName is set, ACME requires that the value is also present in the list of dnsNames or ipAddresses: "redpanda-redpanda-cert" does not exist in [redpanda-cluster.redpanda.redpanda.svc.cluster.local redpanda-cluster.redpanda.redpanda.svc redpanda-cluster.redpanda.redpanda *.redpanda-cluster.redpanda.redpanda.svc.cluster.local *.redpanda-cluster.redpanda.redpanda.svc *.redpanda-cluster.redpanda.redpanda redpanda.redpanda.svc.cluster.local redpanda.redpanda.svc redpanda.redpanda *.redpanda.redpanda.svc.cluster.local *.redpanda.redpanda.svc *.redpanda.redpanda *.adnapder.com] or []
    Reason:                Failed
    Status:                False
    Type:                  Ready
  Failure Time:            2023-01-20T16:02:16Z
Events:
  Type     Reason              Age    From                                                Message
  ----     ------              ----   ----                                                -------
  Normal   WaitingForApproval  8m40s  cert-manager-certificaterequests-issuer-selfsigned  Not signing CertificateRequest until it is Approved
  Normal   WaitingForApproval  8m40s  cert-manager-certificaterequests-issuer-venafi      Not signing CertificateRequest until it is Approved
  Normal   WaitingForApproval  8m40s  cert-manager-certificaterequests-issuer-acme        Not signing CertificateRequest until it is Approved
  Normal   WaitingForApproval  8m40s  cert-manager-certificaterequests-issuer-ca          Not signing CertificateRequest until it is Approved
  Normal   WaitingForApproval  8m40s  cert-manager-certificaterequests-issuer-vault       Not signing CertificateRequest until it is Approved
  Warning  InvalidOrder        8m40s  cert-manager-certificaterequests-issuer-acme        The CSR PEM requests a commonName that is not present in the list of dnsNames or ipAddresses. If a commonName is set, ACME requires that the value is also present in the list of dnsNames or ipAddresses: "redpanda-redpanda-cert" does not exist in [redpanda-cluster.redpanda.redpanda.svc.cluster.local redpanda-cluster.redpanda.redpanda.svc redpanda-cluster.redpanda.redpanda *.redpanda-cluster.redpanda.redpanda.svc.cluster.local *.redpanda-cluster.redpanda.redpanda.svc *.redpanda-cluster.redpanda.redpanda redpanda.redpanda.svc.cluster.local redpanda.redpanda.svc redpanda.redpanda *.redpanda.redpanda.svc.cluster.local *.redpanda.redpanda.svc *.redpanda.redpanda *.adnapder.com] or []
  Normal   cert-manager.io     8m40s  cert-manager-certificaterequests-approver           Certificate request has been approved by cert-manager.io
```

```
ubuntu@master:~$ kubectl describe certificaterequest redpanda-vlg6h -n redpanda
```

```
Events:
  Type    Reason              Age   From                                                Message
  ----    ------              ----  ----                                                -------
  Normal  WaitingForApproval  10m   cert-manager-certificaterequests-issuer-vault       Not signing CertificateRequest until it is Approved
  Normal  WaitingForApproval  10m   cert-manager-certificaterequests-issuer-venafi      Not signing CertificateRequest until it is Approved
  Normal  WaitingForApproval  10m   cert-manager-certificaterequests-issuer-acme        Not signing CertificateRequest until it is Approved
  Normal  WaitingForApproval  10m   cert-manager-certificaterequests-issuer-ca          Not signing CertificateRequest until it is Approved
  Normal  WaitingForApproval  10m   cert-manager-certificaterequests-issuer-selfsigned  Not signing CertificateRequest until it is Approved
  Normal  cert-manager.io     10m   cert-manager-certificaterequests-approver           Certificate request has been approved by cert-manager.io
  Normal  OrderCreated        10m   cert-manager-certificaterequests-issuer-acme        Created Order resource redpanda/redpanda-vlg6h-2611312085
```