0

我正在使用 ZeroSSL 帐户来创建 ACME 证书。我能够从 ZeroSSL 获取 EAB 凭据，并将其添加到 ClusterIssuer。

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: zerossl-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme.zerossl.com/v2/DV90
    externalAccountBinding:
      keyID: keyidFromZeroSSL
      keySecretRef:
        name: zerossl-eabsecret
        key: value
      keyAlgorithm: HS256
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: zerossl-prod
    solvers:
    - dns01:
        route53:
          region: eu-central-1

发行者在集群中设置成功。这里没有问题。

接下来，当我使用我的 CSR 创建 CertificateRequest 时，它永远不会进入就绪状态。即使我可以看到在 ZeroSSL 上创建了证书，我也无法在 cert-manager 中看到 CeritificateRequest 已准备好。

这是在 CertificateRequest 中：

message: 'Waiting on certificate issuance from order default/mytestcert-4230347456:
      "ready"'
    reason: Pending
    status: "False"
    type: Ready

这在日志中

E0129 09:27:23.134393       1 controller.go:143] cert-manager/controller/certificaterequests-issuer-acme "msg"="re-queuing item  due to error processing" "error"="Operation cannot be fulfilled on certificaterequests.cert-manager.io \"mytestcert\": the object has been modified; please apply your changes to the latest version and try again" "key"="default/mytestcert

I0129 09:27:23.092737       1 sync.go:77] cert-manager/controller/orders "msg"="Creating new ACME order as status.url is not set" "resource_kind"="Order" "resource_name"="mytestcert-4230347456" "resource_namespace"="default"

I0129 09:27:23.092865       1 sync.go:190] cert-manager/controller/orders "msg"="order URL not set, submitting Order to ACME server" "resource_kind"="Order" "resource_name"="mytestcert-4230347456" "resource_namespace"="default"

我还能够在 Route53 中看到并创建了 ACME 记录。

*这是我在订单描述中看到的：

dnsNames:
- subdomain.dev.domain.com
- '*.mytestcert.subdomain.dev.domain.com'
issuerRef:
kind: ClusterIssuer
name: zerossl-prod
status:
  authorizations:
  - challenges:
    - token: Dx6JuVjZvrqOVCt0XnZBA_hZ4b4dsMYWikYdZ7Muovs
      type: dns-01
      url: https://acme.zerossl.com/v2/DV90/chall/FuZk8FkdUBEA3l3sPtcKBw
    identifier: mytestcert.subdomain.dev.domain.com
    initialState: pending
    url: https://acme.zerossl.com/v2/DV90/authz/M-Xy9ZHTMplpBXjvxpcnPg
    wildcard: true
  - challenges:
    - token: JlYucJq9g8JhcR1PbQA-24AMT0jurB0CWmvytcJccn4
      type: http-01
      url: https://acme.zerossl.com/v2/DV90/chall/fJPyzw1G82XM6vsPj4pciw
    - token: 4Q9KKoyMP0FDX-mmJEGmz4xcI3lmEISvo_izFqsk-I0
      type: dns-01
      url: https://acme.zerossl.com/v2/DV90/chall/11o2BonMlGgHnJp65oDIDg
    identifier: subdomain.dev.domain.com
    initialState: pending
    url: https://acme.zerossl.com/v2/DV90/authz/cPBHkbnLvEqMZYg0A_BJ_Q
    wildcard: false
  finalizeURL: https://acme.zerossl.com/v2/DV90/order/ZoWmwVynu0IQ31CC-jy3BA/finalize
  state: ready
  url: https://acme.zerossl.com/v2/DV90/order/ZoWmwVynu0IQ31CC-jy3BA

*这是我在挑战中设置观察者的时候

mytestcert-322629104-1271033422   pending   mytestcert.subdomain.dev.domain.com   73s
mytestcert-322629104-2202102765   pending   subdomain.dev.domain.com                    73s
mytestcert-322629104-1271033422   valid     mytestcert.subdomain.dev.domain.com   100s
mytestcert-322629104-2202102765   valid     subdomain.dev.domain.com                    100s
mytestcert-322629104-1271033422   valid     mytestcert.subdomain.dev.domain.com   111s
mytestcert-322629104-2202102765   valid     subdomain.dev.domain.com                    111s
mytestcert-322629104-3344217095             mytestcert.subdomain.dev.domain.com   0s
mytestcert-322629104-2697588659             subdomain.dev.domain.com                    0s
mytestcert-322629104-1271033422   valid     mytestcert.subdomain.dev.domain.com   2m16s
mytestcert-322629104-3344217095             mytestcert.subdomain.dev.domain.com   26s
mytestcert-322629104-2202102765   valid     subdomain.dev.domain.com                    2m17s
mytestcert-322629104-3344217095   pending   mytestcert.subdomain.dev.domain.com   26s
mytestcert-322629104-2697588659             subdomain.dev.domain.com                    27s
mytestcert-322629104-2697588659   pending   subdomain.dev.domain.com                    27s

*这是我在订单上设置观察者的时候：

mytestcert-322629104   pending   79s
mytestcert-322629104   ready     2m8s
mytestcert-322629104   valid     2m18s
mytestcert-322629104   valid     2m18s
mytestcert-322629104             0s
mytestcert-322629104   pending   0s
mytestcert-322629104   pending   0s
mytestcert-322629104   ready     107s
mytestcert-322629104   valid     117s
mytestcert-322629104   valid     117s
mytestcert-322629104             0s
mytestcert-322629104   pending   0s
mytestcert-322629104   pending   0s

同时 cert-manager 尝试生成/检索证书，我可以看到它在 ZeroSSL 中创建了大约 4 个证书。可以从 ZeroSSL 下载证书，而且看起来不错。

但是我无法从 ZeroSSL 手动下载证书，因为我依靠我的应用程序代码从 cert-manager 获取证书。

4

0 回答 0