cert-manager HTTP-01 challenge returns 404 in CI
For an HTTP-01 challenge, the ACME server fetches a token at http://<domain>/.well-known/acme-challenge/<token>. A 404 means that request did not reach the temporary solver pod cert-manager created. The usual causes are Ingress rules that do not route the well-known path to the solver, or DNS pointing the domain at a host that is not the cluster. Fix routing so the challenge path resolves to the solver.
What this error means
The Order/Challenge reports a 404 for the well-known path, and validation fails with "wrong status code '404'" or "Invalid response from http://.../.well-known/acme-challenge/...".
Waiting for HTTP-01 challenge propagation: wrong status code '404',
expected '200'
Invalid response from http://example.com/.well-known/acme-challenge/abc123: 404Common causes
Ingress does not route the challenge path to the solver
An Ingress rule or path priority sends /.well-known/acme-challenge/ to the app instead of the temporary solver pod, so the token is not found.
DNS points the domain away from the cluster
The A/AAAA record resolves to a host that is not serving the solver, so the ACME server hits the wrong backend and gets a 404.
How to fix it
Route the well-known path to the solver
- Confirm the Ingress class matches the one cert-manager solves for.
- Ensure
/.well-known/acme-challenge/is not shadowed by a catch-all rule. - Verify DNS for the domain resolves to the cluster ingress.
curl -s -o /dev/null -w "%{http_code}\n" \
http://example.com/.well-known/acme-challenge/testMatch the ingress class in the issuer
Set the HTTP-01 solver ingress class to the controller actually handling traffic for the domain.
solvers:
- http01:
ingress:
class: nginxHow to prevent it
- Keep
/.well-known/acme-challenge/reachable and unshadowed by app routes. - Confirm DNS points the domain at the cluster ingress before issuance.
- Match the solver ingress class to the live controller.