cert-manager: the HTTP-01 challenge returns 308 (missing ingressClassName in the solver) and other self-check failures
ingressClassName: nginx inside solvers.http01.ingress and delete the stuck Challenge. If the self-check cannot reach the public IP from inside the cluster, it is NAT reflection or split DNS, not cert-manager.