Ingress nginx cert-manager certificate invalid on browser - kubernetes

Question

I am experiencing a rather weird issue and have been stuck on this for 2 days. I have a kubernetes cluster running nginx-ingress and cert-manager. Everything seems to be working fine though when visiting my website through HTTPS, it gives the following error (in chromium edge):
NET::ERR_CERT_AUTHORITY_INVALID
If I continue anyways, it loads the site normally but without the certificate.
The certificate is properly being given, secret created, no errors anywhere.
I have the following annotations in my ingress resource:
kubernetes.io/ingress.class: "nginx"
kubernetes.io/tls-acme: "true"
cert-manager.io/cluster-issuer: "letsencrypt-production"
ingress.kubernetes.io/ssl-redirect: "true"
My cluster issuer:
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
# The ACME production api URL
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: *********
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-production
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: nginx
The certificate resource returns:
Normal Issuing 108s cert-manager The certificate has been successfully issued
I am relatively new to kubernetes so let me know if there are any other debugging steps I can take.

Answer 1

You are using acme staging server: https://acme-staging-v02.api.letsencrypt.org/directory server which does not provide valid certificate.
To get valid certificate you have to use acme production server server: https://acme-v02.api.letsencrypt.org/directory.
you can try this.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
# The ACME production api URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: *********
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-production
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: nginx