How to fix cert-manager failed issue in Kubernetes

View detailed status of the failing certificate:

kubectl describe certificate <cert-name>
kubectl get certificate <cert-name> -o yaml

Look for "Ready: False" and check conditions for specific error.

Ensure the issuer is properly configured and ready:

kubectl describe issuer <issuer-name>
kubectl describe clusterissuer <issuer-name>

If not Ready, check CA certificate validity or ACME account status.

Check if CertificateRequest shows where issuance failed:

kubectl get certificaterequest
kubectl describe certificaterequest <req-name>

This shows detailed error from the issuer.

For ACME issuers, examine challenge resources:

kubectl get challenge
kubectl describe challenge <challenge-name>

Look for "DNS name does not point to Waiting validation server" or HTTP connection errors.

For DNS-01 challenges, verify DNS is correctly configured:

nslookup _acme-challenge.example.com
dig _acme-challenge.example.com TXT

DNS record must exist before ACME server checks it.

For HTTP-01 challenges, verify the validation endpoint is reachable:

curl -v http://example.com/.well-known/acme-challenge/<token>

Must return the validation token, not redirect or 404.

If issuer uses invalid email (@example.com), delete and recreate:

kubectl delete secret letsencrypt-account -n cert-manager
kubectl delete issuer <issuer-name>
# Recreate issuer with valid email

Use real email addresses for production ACME accounts.

Check controller logs for detailed error information:

kubectl logs -n cert-manager deploy/cert-manager --tail=100
kubectl logs -n cert-manager deploy/cert-manager-webhook --tail=100

Look for specific validation or API errors.