Tell the project team how you are using cert-manager Take this short anonymous survey

Akamai

Edge DNS

Use Edge DNS to solve DNS01 ACME challenges by creating a Secret using Akamai API credentials and an Issuer that references the Secret and sets the solver type.

Create a Secret

The Secret should look like the following for the Issuer to reference. Replace use_akamai_client_secret, use_akamai_access_token and use_akamai_client_token with the respective Akamai API credential values.

apiVersion: v1
kind: Secret
metadata:
name: akamai-secret
type: Opaque
stringData:
clientSecret: use_akamai_client_secret
accessToken: use_akamai_access_token
clientToken: use_akamai_client_token

Create an Issuer

To set Edge DNS for challenge tokens, cert-manager uses an Issuer that references the above Secret and other attributes such as the solver type. The Issuer should look like the following. Replace use_akamai_host with the Akamai API credential host value.

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: letsencrypt-akamai-dns
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: contact@me.com
privateKeySecretRef:
name: letsencrypt-akamai-issuer-account-key
solvers:
- dns01:
akamai:
serviceConsumerDomain: use_akamai_host
clientTokenSecretRef:
name: akamai-secret
key: clientToken
clientSecretSecretRef:
name: akamai-secret
key: clientSecret
accessTokenSecretRef:
name: akamai-secret
key: accessToken

Create a Certificate

The Certificate should look like the following and reference the Akamai Edge DNS Issuer above.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: example-zone
spec:
secretName: akamai-crt-secret
dnsNames:
- '*.example.zone'
issuerRef:
name: letsencrypt-akamai-dns
kind: Issuer

Note: cert-manager will wait for challenge tokens to propagate across the Edge DNS network. Follow the certificate status with a command such as the following.

kubectl describe certificate example-zone

Troubleshooting

Follow the cert-manager events to identify any issues with a command such as the following.

cmctl status certificate example-zone