mirror of
https://github.com/wahyd4/cert-manager.git
synced 2026-08-20 02:26:47 +10:00
Joe Heck
facf1e9fb4
- fixed missing blank line in ref docs code block - updated references to sphinx docs - included documentation notes into the docs index Signed-off-by: Joe Heck <heckj@mac.com>
45 lines
1.5 KiB
ReStructuredText
45 lines
1.5 KiB
ReStructuredText
=========================
|
|
HTTP01 Challenge Provider
|
|
=========================
|
|
|
|
In order to allow HTTP01 challenges to be solved, we must enable the HTTP01
|
|
challenge provider on our Issuer resource.
|
|
|
|
This is done through setting the ``http01`` field on the ``issuer.spec.acme``
|
|
stanza. Cert-manager will then attempt to solve ACME HTTP-01 challenges by
|
|
using Ingress resources
|
|
|
|
.. code-block:: yaml
|
|
:linenos:
|
|
:emphasize-lines: 7, 11
|
|
|
|
apiVersion: certmanager.k8s.io/v1alpha1
|
|
kind: Issuer
|
|
metadata:
|
|
name: example-issuer
|
|
spec:
|
|
acme:
|
|
email: user@example.com
|
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
privateKeySecretRef:
|
|
name: example-issuer-account-key
|
|
http01: {}
|
|
|
|
|
|
In rare cases it might be not possible/desired to use NodePort as type for the http01 challenge response service, e.g. because of Kubernetes limit restrictions. To define which Kubernetes service type to use during challenge response specify the following http01 config
|
|
|
|
.. code-block:: yaml
|
|
|
|
http01:
|
|
# Valid values are ClusterIP and NodePort
|
|
serviceType: ClusterIP
|
|
|
|
By default type NodePort will be used when you don't set http01 or when you set serviceType to an empty string. Normally there's no need to change this.
|
|
|
|
.. note::
|
|
Let's Encrypt does not support issuing wildcard certificates with HTTP-01 challenges.
|
|
To issue wildcard certificates, you must use the DNS-01 challenge.
|
|
|
|
.. todo::
|
|
Write a full description of how HTTP01 challenge validation works
|