Ingress New Added 17 October 2026

cert-manager: Failed to determine a valid solver configuration

None of the solvers on the Issuer matches the domains being requested, so cert-manager has no way to attempt a challenge. Solvers can be limited with a selector by dnsNames, dnsZones or labels, and a new hostname, a wildcard needing DNS01 while only HTTP01 is configured, or an Ingress pointing at the wrong Issuer all leave the order with nothing to try.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix

# The order lists which domains could not be matched
kubectl get order -n prod
kubectl describe order -n prod <order-name> | tail -20

# Inspect solvers and their selectors on the issuer
kubectl get clusterissuer letsencrypt -o yaml | sed -n "/solvers:/,$p"

# Wildcards (*.example.com) can only be solved with DNS01
# solvers:
# - dns01: { cloudflare: { apiTokenSecretRef: { name: cf-token, key: token } } }
#   selector: { dnsZones: ["example.com"] }
# - http01: { ingress: { ingressClassName: nginx } }

# Retry once the issuer is fixed
cmctl renew app-tls -n prod

How to diagnose Ingress errors

An Ingress failure is a routing failure, and there are only a few places it can break: the IngressClass is missing so no controller claims the resource, the path or host does not match, the backing Service has no endpoints, or the TLS secret is absent or in the wrong namespace. The "default backend - 404" page is the controller saying it received the request but found no rule for it.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

Work backwards from the pod: kubectl get endpoints <service>. If it is empty, the Service selector does not match any ready pod and no Ingress configuration will help.
Check that a controller has claimed the Ingress: kubectl describe ingress <name> should show events and an assigned address. No address means no controller is watching that IngressClass.
Read the controller's own logs (kubectl logs -n ingress-nginx deploy/ingress-nginx-controller). They log rejected configuration and certificate problems explicitly.
Remember TLS secrets must live in the same namespace as the Ingress. This is the single most common TLS mistake.
Verify path type semantics: Prefix, Exact and ImplementationSpecific match differently, and regex behaviour varies between controllers.

Tools worth reaching for

kubectl describe ingress
kubectl get endpoints
controller logs
curl -H 'Host: …'
openssl s_client -servername

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

cert-manager.io cert-manager.io

Related Ingress errors

See all 20 Ingress errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.