nginx ingress with client cert auth - cert-manager acme challenge

[akaaabos]

Hi All, I have been trying to do a auto renewal of lets encrypt certs using cert-manger through http acme challenge in nginx ingress where im doing auth-tls-verify-client. Since the endpoint is secured by client cert auth - it looks like challenge is not approved yet because the http call from cert-manger doesnt have the right Client cert to authenticate. Is there any way to just to allow cert-manger calls without client cert auth ?

Here is my annotations:

cert-manager.io/cluster-issuer: letsencrypt-prod
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-tls-secret: default/ca-bundle-secret
nginx.ingress.kubernetes.io/auth-tls-verify-client: 'on'
nginx.ingress.kubernetes.io/auth-tls-verify-depth: '2'
nginx.ingress.kubernetes.io/proxy-body-size: 512m
nginx.ingress.kubernetes.io/server-snippet: >
  if ($ssl_client_i_dn !~ "(CN=CNames)")
  {
    return 403 " 403 Forbidden - Wrong client cert";
  }
nginx.ingress.kubernetes.io/ssl-redirect: 'false' 

Any suggestion helps. Thanks!!

[jjngx]

@akaaabos could you please let us know if you use kubernetes-ingress project?