CertManager&#39;s 10s TLS handshake error EOF #487

Originally created by @ventsislav-georgiev on GitHub (Apr 28, 2023).

Version: 0.22.1
Usage: Kubernetes

When using the LetsEncrypt auto certificate provisioning. There is a constant error in the logs.
Seems to be related to this issue: https://github.com/cert-manager/cert-manager/issues/4594

Is it expected or there is a way around it?

Originally created by @ventsislav-georgiev on GitHub (Apr 28, 2023). Version: 0.22.1 Usage: Kubernetes When using the LetsEncrypt auto certificate provisioning. There is a constant error in the logs. Seems to be related to this issue: https://github.com/cert-manager/cert-manager/issues/4594 <img width="527" alt="image" src="https://user-images.githubusercontent.com/5616486/235007466-2427e42f-7c3a-45f3-af21-e22a5b2e91d6.png"> Is it expected or there is a way around it?

adam added the stale bug labels 2025-12-29 02:18:59 +01:00

adam closed this issue

adam commented

@loprima-l commented on GitHub (Apr 28, 2023):

Is the connection with 10.36.2.1 working well ? Have you tried that (https://github.com/cert-manager/cert-manager/issues/4594#issuecomment-997164924) ?

@loprima-l commented on GitHub (Apr 28, 2023): Is the connection with 10.36.2.1 working well ? Have you tried that (https://github.com/cert-manager/cert-manager/issues/4594#issuecomment-997164924) ?

adam commented

@ventsislav-georgiev commented on GitHub (Apr 28, 2023):

@loprima-l There is no such pod in the cluster. Isn't in headscale the certmanager server started internally in the same process?

As for the 10.36.2.1 connectivity. That is the default gateway and all our things work as expected.

I forgot to mention an important detail.. The logs above don't break any functionality. The SSL certificate is provisioned successfully and connections from tailscale clients work as expected. All is working, except it constantly logs this EOF error.

@ventsislav-georgiev commented on GitHub (Apr 28, 2023): @loprima-l There is no such pod in the cluster. Isn't in headscale the certmanager server started internally in the same process? As for the 10.36.2.1 connectivity. That is the default gateway and all our things work as expected. I forgot to mention an important detail.. The logs above don't break any functionality. The SSL certificate is provisioned successfully and connections from tailscale clients work as expected. All is working, except it constantly logs this EOF error.

adam commented

@loprima-l commented on GitHub (Apr 29, 2023):

Thanks for your reply I'm just starting on Headscale so TLS wasn't the first thing I checked. I will look at it when I've got the time as it's not a major outage.

@loprima-l commented on GitHub (Apr 29, 2023): Thanks for your reply I'm just starting on Headscale so TLS wasn't the first thing I checked. I will look at it when I've got the time as it's not a major outage.

adam commented

@loprima-l commented on GitHub (May 1, 2023):

@ventsislav-georgiev Hi, have you created your instance based on the example directory ?

@loprima-l commented on GitHub (May 1, 2023): @ventsislav-georgiev Hi, have you created your instance based on the example directory ?

adam commented

@ventsislav-georgiev commented on GitHub (May 1, 2023):

@loprima-l What do you mean exactly? I've deployed headscale to a Kubernetes cluster using a helm chart from gabe565 and the configuration used is based in the examples yes.

@ventsislav-georgiev commented on GitHub (May 1, 2023): @loprima-l What do you mean exactly? I've deployed headscale to a Kubernetes cluster using a helm chart from gabe565 and the configuration used is based in the examples yes.

adam commented

@loprima-l commented on GitHub (May 1, 2023):

The version of cert-manager in this file is responsible for the bug you've described I think, I'm not familiar with Kubernetes but maybe updating it would fix your issue, can you try it ?

@loprima-l commented on GitHub (May 1, 2023): The version of cert-manager in this [file](https://github.com/juanfont/headscale/blob/main/examples/kustomize/install-cert-manager.bash) is responsible for the bug you've described I think, I'm not familiar with Kubernetes but maybe updating it would fix your issue, can you try it ?

adam commented

@ventsislav-georgiev commented on GitHub (May 1, 2023):

Hmm.. I haven't deployed cert manager at all and I don't think it is part of the helm chart as I don't see any deployment in the cluster related to cert manager. That is why I think it is used internally by headscale.

@ventsislav-georgiev commented on GitHub (May 1, 2023): Hmm.. I haven't deployed cert manager at all and I don't think it is part of the helm chart as I don't see any deployment in the cluster related to cert manager. That is why I think it is used internally by headscale.

adam commented

@loprima-l commented on GitHub (May 1, 2023):

I can't find it in the dependencies ...
@juanfont any idea ?

@loprima-l commented on GitHub (May 1, 2023): I can't find it in the dependencies ... @juanfont any idea ?

adam commented

@ventsislav-georgiev commented on GitHub (May 1, 2023):

@loprima-l it seems autocert is used. Here is the code: https://github.com/juanfont/headscale/blob/main/app.go#L843

The ref to certmanager issue I provided is matching the error message. I'm not sure if autocert and certmanager are related.

@ventsislav-georgiev commented on GitHub (May 1, 2023): @loprima-l it seems autocert is used. Here is the code: https://github.com/juanfont/headscale/blob/main/app.go#L843 The ref to certmanager issue I provided is matching the error message. I'm not sure if autocert and certmanager are related.

adam commented

@github-actions[bot] commented on GitHub (Oct 29, 2023):

This issue is stale because it has been open for 180 days with no activity.

@github-actions[bot] commented on GitHub (Oct 29, 2023): This issue is stale because it has been open for 180 days with no activity.

adam commented