How to fix ACME challenge failed in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 163 views

The ACME challenge failed error occurs when cert-manager cannot validate domain ownership with Let's Encrypt during TLS certificate provisioning. This typically blocks certificate issuance and renewal, preventing HTTPS traffic. Common causes include DNS propagation issues, HTTP endpoint accessibility problems, and rate limiting violations.

Quick fix

Fixes ACME challenge failed

kubectl describe challenge
kubectl describe order
  1. Debug the challenge failure
  2. Verify Let's Encrypt can reach your endpoints
  3. Fix HTTP-01 challenge issues
  4. Fix DNS-01 challenge issues
kubernetes — error
kubectl describe challenge
kubectl describe order
ACME challenge failed

What this error means

This error indicates that your Kubernetes cluster, using cert-manager with Let's Encrypt, failed to complete the ACME challenge process. ACME (Automated Certificate Management Environment) requires domain ownership validation before issuing TLS certificates. The failure prevents certificate creation or renewal, which means your applications cannot serve HTTPS traffic. The error can occur at different stages: DNS validation (DNS-01), HTTP validation (HTTP-01), or self-verification checks.

Typical symptoms

  • Certificate remains in Pending state for hours or days
  • ACME Order creation fails with 429 or 401 errors
  • Challenge self-check failures visible in kubectl describe challenge output
  • DNS records appear correct externally but fail from within the cluster
  • HTTP challenge endpoints unreachable from the public internet
  • Logs show "Waiting for DNS-01 challenge propagation" or similar messages

Common causes

  1. DNS propagation issues where _acme-challenge TXT records are not visible from cluster DNS servers
  2. Cloud provider DNS overrides preventing TXT record resolution
  3. HTTP-01 challenge failures due to ingress LoadBalancer with externalTrafficPolicy set to Local
  4. Firewall or network policy blocking Let's Encrypt servers from accessing challenge URLs
  5. Rate limiting (429 errors) from exceeding 5 failures per account/hostname/hour threshold
  6. TLS handshake failures on challenge endpoints requiring temporary self-signed certificates
  7. Self-check timeouts from DNS timeouts or connection refused errors

How to fix "ACME challenge failed"

1Debug the challenge failure

First, inspect the challenge and order objects to understand why validation failed:

bash
kubectl describe challenge
kubectl describe order

Look for error messages indicating DNS or HTTP validation failures. The output will show the specific challenge type (dns01 or http01) and any error messages from the validation attempt.

2Verify Let's Encrypt can reach your endpoints

For HTTP-01 challenges, verify that Let's Encrypt servers can reach your challenge URL:

bash
curl -I http://yourdomain.com/.well-known/acme-challenge/test-token

For DNS-01 challenges, verify TXT records are visible externally:

bash
dig _acme-challenge.yourdomain.com TXT @8.8.8.8
3Fix HTTP-01 challenge issues

If using HTTP-01, check your ingress LoadBalancer configuration:

yaml
apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
spec:
  externalTrafficPolicy: Cluster

Also verify no client certificate authentication blocks the ACME validation endpoints.

4Fix DNS-01 challenge issues

For DNS-01 challenges, configure cert-manager to use a specific DNS server for self-checks:

yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - dns01:
        cloudflare:
          apiTokenSecretRef:
            name: cloudflare-api
            key: token

Verify DNS provider credentials are correct and API access is enabled.

5Handle rate limiting

If you see 429 errors, you've hit Let's Encrypt rate limits. Use the staging issuer first:

yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory

Wait 1 hour before retrying with the production issuer.

6Enable temporary certificates

For TLS handshake failures, enable temporary certificate generation:

yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
spec:
  dnsNames:
  - example.com
  issuerRef:
    name: letsencrypt-prod
  issueTemporaryCertificate: true

This allows the ingress to start with a temporary cert while the ACME challenge completes.

7Use in-place HTTP challenge resolution

For multiple resources on the same hostname, use:

yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    acme.cert-manager.io/http01-edit-in-place: "true"

This allows cert-manager to modify your existing ingress for the challenge rather than creating a new one.

Advanced notes

Platform-specific considerations: EKS, AKS, and GKE often override cluster DNS servers, causing DNS-01 failures; explicitly configure DNS servers in cert-manager solver specs. Cloudflare and Route53 require valid API credentials and rate limit monitoring on the DNS provider side. For production deployments, test with the Let's Encrypt staging issuer first to avoid hitting rate limits and causing extended outages.

Frequently asked questions

What does "ACME challenge failed" mean?
This error indicates that your Kubernetes cluster, using cert-manager with Let's Encrypt, failed to complete the ACME challenge process. ACME (Automated Certificate Management Environment) requires domain ownership validation before issuing TLS certificates. The failure prevents certificate creation or renewal, which means your applications cannot serve HTTPS traffic.
How do I fix "ACME challenge failed"?
The ACME challenge failed error occurs when cert-manager cannot validate domain ownership with Let's Encrypt during TLS certificate provisioning. This typically blocks certificate issuance and renewal, preventing HTTPS traffic. Common causes include DNS propagation issues, HTTP endpoint accessibility problems, and rate limiting violations.
What causes "ACME challenge failed"?
DNS propagation issues where _acme-challenge TXT records are not visible from cluster DNS servers Cloud provider DNS overrides preventing TXT record resolution HTTP-01 challenge failures due to ingress LoadBalancer with externalTrafficPolicy set to Local
Is the "ACME challenge failed" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading