Existing issued Secret is not up to date for spec: [spec.dnsNames]

[zz40404991]

Where should dnsNames be added?

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  dnsNames:
    - 'myweb.xyz'
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: myweb@163.com
    privateKeySecretRef:
      name: letsencrypt-prod
    disableAccountKeyGeneration: false
    solvers:
      - http01:
          ingress:
            class: nginx

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: web-nginx
  annotations:
    kubernietes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/tls-acme: "true"
spec:
  tls:
  - hosts:
    - myweb.xyz
    secretName: myweb-tls
  rules:
    - host: myweb.xyz
      http:
        paths:
        - path: /
          backend:
            serviceName: web-nginx
            servicePort: 32601


Status:
  Conditions:
    Last Transition Time:        2020-09-09T09:56:32Z
    Message:                     Existing issued Secret is not up to date for spec: [spec.dnsNames]
    Reason:                      SecretMismatch
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2020-09-09T09:56:32Z
    Message:                     Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
    Reason:                      IncorrectIssuer
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  myweb-tls-nkz8g
  Not After:                     2020-12-02T12:00:00Z
  Not Before:                    2019-12-03T00:00:00Z
  Renewal Time:                  2020-11-02T12:00:00Z

[meyskens]

dnsNames is a property on the Certificate resource: https://cert-manager.io/docs/usage/certificate/

/triage support

[dedanirungu]

Does it work with Ingress configuration. https://cert-manager.io/docs/usage/ingress/

`apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
# add an annotation indicating the issuer to use.
cert-manager.io/cluster-issuer: nameOfClusterIssuer
name: myIngress
namespace: myIngress
spec:
rules:

• host: example.com
  http:
  paths:
  • backend:
    serviceName: myservice
    servicePort: 80
    path: /
    tls: # < placing a host in the TLS config will indicate a certificate should be created
• hosts:
  • example.com
    secretName: myingress-cert # < cert-manager will store the created certificate in this secret.`

[meyskens]

If you use the ingress anotations cert-manager will use the hosts field in the TLS value for composing the DNS Names for the certificate

[jhancock4d]

I'm getting this issue too. Used to work fine, now broken in 1.8.0

The dnsNames are there but it errors on this with reason "SecretMismatch"

[vyom-soft]

Same issue, seem that it is broken with cert manager 1.8.0
` Conditions:
Last Transition Time: 2022-05-30T11:56:46Z
Message: Existing issued Secret is not up to date for spec: [spec.dnsNames]
Observed Generation: 1
Reason: SecretMismatch
Status: False
Type: Ready
Last Transition Time: 2022-05-30T11:56:46Z
Message: Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
Observed Generation: 1
Reason: IncorrectIssuer
Status: True
Type: Issuing
Next Private Key Secret Name: my-prod-ca-58vkq
Not After: 2027-05-24T18:22:32Z
Not Before: 2022-05-25T18:22:32Z
Renewal Time: 2025-09-23T10:22:32Z
Events:
Type Reason Age From Message

---

Normal Issuing 38s cert-manager-certificates-trigger Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
Normal Reused 38s cert-manager-certificates-key-manager Reusing private key stored in existing Secret resource "my-prod-ca"
Normal Requested 38s cert-manager-certificates-request-manager Created new CertificateRequest resource "my-prod-ca-tw7bg"`

Where should I do the changes ? to get going

Thank you

[lengeru]

Same issue, seem that it is broken in cert manager 1.9.0 also.

Status:
Conditions:
Last Transition Time: 2022-08-11T12:09:30Z
Message: Existing issued Secret is not up to date for spec: [spec.dnsNames]
Observed Generation: 1
Reason: SecretMismatch
Status: False
Type: Ready
Last Transition Time: 2022-08-11T12:09:30Z
Message: Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
Observed Generation: 1
Reason: IncorrectIssuer
Status: True
Type: Issuing
Next Private Key Secret Name: xxx-tls-secret-jwbvw
Not After: 2023-08-11T11:46:09Z
Not Before: 2022-08-11T11:46:09Z
Renewal Time: 2023-04-11T19:46:09Z
Events:
Type Reason Age From Message

---

Normal Issuing 10m cert-manager-certificates-trigger Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
Normal Reused 10m cert-manager-certificates-key-manager Reusing private key stored in existing Secret resource "xxx-tls-secret"
Normal Requested 10m cert-manager-certificates-request-manager Created new CertificateRequest resource "xxx-tls-secret-6pv5s"

[MichaelAkvo]

This is happening in v 1.10.0 as well from certificates generated when using an ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: akvo
  namespace: default
  annotations:
    kubernetes.io/tls-acme: "true"
    certmanager.k8s.io/cluster-issuer: "letsencrypt"
spec:
  tls:
    - hosts:
        - "*.akvotest.org"
      secretName: tls-cert-manager
  rules:
    - host: "flow-services.akvotest.org"
      http:
        paths:
        - pathType: ImplementationSpecific
          backend:
            service:
              name: akvo-flow-services
              port:
                number: 8082

However, the certificate seems to work regardless, so I'm assuming this is not a critical error.

[marsch]

no its not - same here - newest version. tinkering on it for a while

[bumarcell]

Had the same issue just now with 1.13.5.
It was just temporary while the new cert was being issued, then error was gone 👍