Cert-Manager

acme-dns: DNS-01 without handing over the key to the whole zone (CNAME delegation of _acme-challenge) with certbot and cert-manager

NS auth.example.com → acme-dns; POST /register → username, password, fulldomain; CNAME _acme-challenge.example.com → . certbot certonly –manual –manual-auth-hook /etc/letsencrypt/acme-dns-auth.py –preferred-challenges dns -d ‘*.example.com’ -d example.com. On Kubernetes, the dns01.acmeDNS solver with accountSecretRef. acme-dns 2.0.2 (February 2025) is still active.

cert-manager: the HTTP-01 challenge returns 308 (missing ingressClassName in the solver) and other self-check failures

ingressClassName: nginx inside solvers.http01.ingress and delete the stuck Challenge. If the self-check cannot reach the public IP from inside the cluster, it is NAT reflection or split DNS, not cert-manager.