-
Notifications
You must be signed in to change notification settings - Fork 404
Adds troubleshooting guide for host missmatch error - #2023
Adds troubleshooting guide for host missmatch error #2023epatmalnieks-gc wants to merge 1 commit into
Conversation
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign munnerz for approval. For more information see the Code Review Process.
The full list of commands accepted by this bot can be found here.
Details
Needs approval from an approver in each of these files:Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
✅ Deploy Preview for cert-manager ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
35581bd to
6a34733
Compare
Signed-off-by: Edgars Patmalnieks <epatmalnieks@gocardless.com>
6a34733 to
9a2de01
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
⚠️ Not ready to approve
The newly added troubleshooting text is currently misleading/inaccurate about what is mismatching and should be corrected to avoid sending users to the wrong remediation path.
Pull request overview
This PR adds troubleshooting guidance to the ACME troubleshooting documentation for the error ACME server URL host and ACME private key registration host differ, addressing the lack of documented remediation steps referenced in website issue #197.
Changes:
- Add a new "Common errors" bullet describing the ACME account host mismatch error and where to investigate.
File summaries
| File | Description |
|---|---|
| content/docs/troubleshooting/acme.md | Adds a new troubleshooting entry for the ACME account host mismatch error. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 1
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
@wallrj-cyberark
wallrj-cyberark
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for addressing issue #197 — this documentation gap has been open for years and is worth filling. The Copilot review has independently flagged the same concerns below.
I checked the source code and found a few issues with the technical explanation.
1. This is not an error — it is an info-level log message.
The code at pkg/issuer/acme/setup.go:291 uses log.V(logf.InfoLevel).Info(...). When the condition triggers, cert-manager clears the cached account URI and re-checks the ACME registration. It is a self-healing action, not a failure.
2. The explanation of the cause is inaccurate.
The PR says "host resolved by the node differs from the host in your private key". The private key does not contain a host. What the code actually compares (line 290) is parsedAccountURL.Host (from issuer.status.acme.uri — the ACME account URL cached from a previous registration) against parsedServerURL.Host (from issuer.spec.acme.server — the configured ACME server URL).
Common causes include:
- Changing the ACME server URL (e.g. from staging to production)
- A stale
searchdomain in/etc/resolv.confcausing DNS to resolve the ACME server hostname differently (this is the scenario from cert-manager/cert-manager#3394) - Reusing a private key Secret from a different Issuer or cluster
3. Missing colon after the backtick-quoted message.
The existing bullet points all use the pattern `message`: explanation. The new entry is missing the colon separator.
A suggested replacement:
ACME server URL host and ACME private key registration host differ: this is an informational message (not an error) indicating that the host in the configured ACME server URL (spec.acme.server) differs from the host where the ACME account was previously registered (status.acme.uri). cert-manager will automatically clear the cached registration and re-check the account. Common causes include: changing the ACME server URL (e.g. from staging to production), a stalesearchdomain in/etc/resolv.conf(see cert-manager/cert-manager#3394), or reusing a private key Secret from a different Issuer. If the re-registration fails, check/etc/resolv.conffor incorrect search domains, or delete the private key Secret referenced by the Issuer to force a clean re-registration.
Uh oh!
There was an error while loading. Please reload this page.
There is an open issue of missing troubleshooting info for
ACME server URL host and ACME private key registration host differThis issue is mentioned also on issue 3394This PR adds a simple description of the error and what would be the reasonable place to look for.