How to fix ACME challenge failed in Kubernetes

First, inspect the challenge and order objects to understand why validation failed:

kubectl describe challenge
kubectl describe order

Look for error messages indicating DNS or HTTP validation failures. The output will show the specific challenge type (dns01 or http01) and any error messages from the validation attempt.

For HTTP-01 challenges, verify that Let's Encrypt servers can reach your challenge URL:

curl -I http://yourdomain.com/.well-known/acme-challenge/test-token

For DNS-01 challenges, verify TXT records are visible externally:

dig _acme-challenge.yourdomain.com TXT @8.8.8.8

If using HTTP-01, check your ingress LoadBalancer configuration:

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
spec:
  externalTrafficPolicy: Cluster

Also verify no client certificate authentication blocks the ACME validation endpoints.

For DNS-01 challenges, configure cert-manager to use a specific DNS server for self-checks:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - dns01:
        cloudflare:
          apiTokenSecretRef:
            name: cloudflare-api
            key: token

Verify DNS provider credentials are correct and API access is enabled.

If you see 429 errors, you've hit Let's Encrypt rate limits. Use the staging issuer first:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory

Wait 1 hour before retrying with the production issuer.

For TLS handshake failures, enable temporary certificate generation:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
spec:
  dnsNames:
  - example.com
  issuerRef:
    name: letsencrypt-prod
  issueTemporaryCertificate: true

This allows the ingress to start with a temporary cert while the ACME challenge completes.

For multiple resources on the same hostname, use:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    acme.cert-manager.io/http01-edit-in-place: "true"

This allows cert-manager to modify your existing ingress for the challenge rather than creating a new one.