search

jetstack / kube-lego

DEPRECATED: Automatically request certificates for Kubernetes Ingress resources from Let's Encrypt
Apache License 2.0
2.16k stars 267 forks source link

Expose details when the ACME identifier authorization fails #276

Open jpaulgs opened 6 years ago

jpaulgs commented 6 years ago

I was trying to setup kube-lego on my cluster this morning and kept on receiving the following error:

time="2017-11-14T22:44:04Z" level=debug msg="error while authorizing: waiting for authorization failed: acme: identifier authorization failed" context=acme domain=....

Which after 5 tries results in being rate limited:

time="2017-11-14T22:44:25Z" level=debug msg="error while authorizing: getting authorization failed: 429 urn:acme:error:rateLimited: Error creating new authz :: Too many failed authorizations recently." context=acme domain=...

In this case the root cause of the error was a CAA record stipulating a different SSL provider. Is kube lego able to log the cause of the errors?

This type of issue doesn't appear to be recoverable so trying until the system gets rate limited is less than ideal. If possible I would actually prefer a hard failure with a useful message.

ldavis-sd commented 5 years ago

@jpaulgs Jerome, thanks so much for putting the details of your issue here, they were instrumental in helping us resolve a difficult issue with Let's Encrypt.