challenge stuck in pending state - certifcate never gets ready

[prashant-shahi]

challenge stuck in pending state - certifcate never gets ready

[speedyflipper]

I'm seeing this error as well

[prashant-shahi]

Encountered it again.

Certificate status:

status:
  conditions:
    - lastTransitionTime: '2023-12-08T04:31:05Z'
      message: Issuing certificate as Secret does not exist
      observedGeneration: 1
      reason: DoesNotExist
      status: 'True'
      type: Issuing
    - lastTransitionTime: '2023-12-08T04:31:05Z'
      message: Issuing certificate as Secret does not exist
      observedGeneration: 1
      reason: DoesNotExist
      status: 'False'
      type: Ready
  nextPrivateKeySecretName: test.redacted.com-tls-smlvs

[speedyflipper]

I'm seeing this error as well

The issue for me was that Cloudflare was flagging the challenges as a bot and was blocking them.

[jonathanribas]

We are running Cert Manager 1.13.3 (same issue with 1.13.1) on Kubernetes 1.28 (EKS).
We had to create a CAA record on our DNS zone to create new certificates or renew existing ones.
Still investigating why we had to do so, it was working correctly in the past.

[chrxmvtik]

I'm seeing this error as well

The issue for me was that Cloudflare was flagging the challenges as a bot and was blocking them.

Could you tell, how you managed to get it fixed? I was searching cloudflare panel for some requests that were flagged as a bot, but didn't find anything.

[speedyflipper]

I'm seeing this error as well

The issue for me was that Cloudflare was flagging the challenges as a bot and was blocking them.

Could you tell, how you managed to get it fixed? I was searching cloudflare panel for some requests that were flagged as a bot, but didn't find anything.

After selecting the site, Security then Events. You should see a list of everything blocked.

I added an IP Access Tool Rule under Security-WAF, that allows any connection from my server's IP address. I wish there was a way to automate this. I know I'm going to forget the next time the ISP changes my IP

[chrxmvtik]

I'm seeing this error as well

The issue for me was that Cloudflare was flagging the challenges as a bot and was blocking them.

Could you tell, how you managed to get it fixed? I was searching cloudflare panel for some requests that were flagged as a bot, but didn't find anything.

After selecting the site, Security then Events. You should see a list of everything blocked.

I added an IP Access Tool Rule under Security-WAF, that allows any connection from my server's IP address. I wish there was a way to automate this. I know I'm going to forget the next time the ISP changes my IP

None of above worked, but when I removed a _acme-challenge TXT record it successfully validated the challenge and everything worked lol.

Weird behaviour, I had this set up for 2 years and it worked like a charm until today.