[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > [Container infrastructure](index.md) > Managed Service for Kubernetes > Working with DNS > DNS challenge for Let's Encrypt® certificates

# DNS Challenge for Let's Encrypt® certificates in Yandex Managed Service for Kubernetes

# DNS challenge for Let's Encrypt® certificates


To add a DNS challenge when issuing [Let's Encrypt® certificates](../../certificate-manager/concepts/managed-certificate.md):

1. [Create a certificate](#create-cert).
1. [Check the result](#check-result).

If you no longer need the resources you created, [delete them](#clear-out).


## Required paid resources {#paid-resources}

The support cost for this solution includes:

* Fee for using the master and outgoing traffic in a Managed Service for Kubernetes cluster (see [Managed Service for Kubernetes pricing](../../managed-kubernetes/pricing.md)).
* Fee for using computing resources, OS, and storage in cluster nodes (VMs) (see [Compute Cloud pricing](../../compute/pricing.md)).
* Fee for a public IP address assigned to cluster nodes (see [Virtual Private Cloud pricing](../../vpc/pricing.md#prices-public-ip)).
* Fee for a DNS zone and DNS requests (see [Cloud DNS pricing](../../dns/pricing.md)).


## Getting started {#before-begin}

1. [Create a service account](../../iam/operations/sa/create.md) with the `dns.editor` [role](../../iam/concepts/access-control/roles.md) for the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) that will contain the [domain zone](../../dns/concepts/dns-zone.md).

1. [Create an authorized key](../../iam/operations/authentication/manage-authorized-keys.md#create-authorized-key) for the [service account](../../iam/concepts/users/service-accounts.md) and save it to a JSON file:

   ```bash
   yc iam key create \
     --service-account-name <service_account_name> \
     --format json \
     --output key.json
   ```

1. [Register a public domain zone and delegate your domain](../../dns/operations/zone-create-public.md). A Let's Encrypt® certificate will be issued for the domain in this zone after you pass the [DNS-01 challenge](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge).

1. [Create security groups](../../managed-kubernetes/operations/connect/security-groups.md) for the Managed Service for Kubernetes cluster and its node groups.

    {% note warning %}
    
    The configuration of security groups determines performance and availability of the cluster and the services and applications running in it.
    
    {% endnote %}

1. [Add](../../vpc/operations/security-group-add-rule.md) the following rules to your security groups:
   
     * Add to the [cluster security group](../../managed-kubernetes/operations/connect/security-groups.md#rules-master) an outbound traffic rule allowing certificate checks via a cert-manager webhook:
       * **Port range**: `10250`.
       * **Protocol**: `TCP`.
       * **Destination name**: `CIDR`.
       * **CIDR blocks**: `0.0.0.0/0`.
     * Add to the [node group security group](../../managed-kubernetes/operations/connect/security-groups.md#rules-internal-nodegroup) an outbound traffic rule allowing connection to Let's Encrypt® servers for certificates:
       * **Port range**: `443`.
       * **Protocol**: `TCP`.
       * **Destination name**: `CIDR`.
       * **CIDR blocks**: `0.0.0.0/0`.
1. [Create a Managed Service for Kubernetes cluster](../../managed-kubernetes/operations/kubernetes-cluster/kubernetes-cluster-create.md) and [node group](../../managed-kubernetes/operations/node-group/node-group-create.md) with any suitable configuration. When creating, specify the preconfigured security groups.

1. [Install kubect](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../../managed-kubernetes/operations/connect/index.md#kubectl-connect).

## Create a certificate {#create-cert}

1. Install `cert-manager` with the Yandex Cloud DNS ACME webhook plugin by following [this guide](../../managed-kubernetes/operations/applications/cert-manager-cloud-dns.md).

    During the installation, specify the service account and the authorized key you created when [getting started](#before-begin).

1. Create a file named `certificate.yaml`:

   ```yaml
   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: example-com
     namespace: default
   spec:
     secretName: example-com-secret
     issuerRef:
       # ClusterIssuer created together with the Yandex Cloud DNS ACME webhook
       name: yc-clusterissuer
       kind: ClusterIssuer
     dnsNames:
       - <domain_name>
   ```

1. Apply the certificate to your Managed Service for Kubernetes cluster:

   ```bash
   kubectl apply -f certificate.yaml
   ```

## Check the result {#check-result}

1. Check the certificate status:

    ```bash
    kubectl get certificate example-com
    ```

    Result:

    ```text
    NAME         READY  SECRET              AGE
    example-com  True   example-com-secret  24h
    ```

    The `True` status in the `READY` column means that the certificate was issued successfully.

1. Optionally, get detailed information about the certificate:

    ```bash
    kubectl -n default describe certificate example-com
    ```

    The command output will contain similar events:
    
    ```text
    Events:
      Type    Reason     Age   From                                       Message
      ----    ------     ----  ----                                       -------
      Normal  Issuing    ...   cert-manager-certificates-trigger          Issuing certificate as Secret does not exist
      Normal  Generated  ...   cert-manager-certificates-key-manager      Stored new private key in temporary Secret resource...
    ```
    
    Certificates are [used bundled with matching Kubernetes secrets](https://cert-manager.io/docs/), which store key pairs and service information. If there is no secret, the certificate is reissued automatically and a new secret is created, with a notification in the events. For more information about certificate reissue, see [this cert-manager guide](https://cert-manager.io/docs/faq/#when-do-certs-get-re-issued).
    
    As the certificate is being issued for the first time, it has no matching secret. Any events notifying about it should not be considered an error.

## Delete the resources you created {#clear-out}

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

1. [Delete the Managed Service for Kubernetes cluster](../../managed-kubernetes/operations/kubernetes-cluster/kubernetes-cluster-delete.md).
1. [Delete the public domain zone](../../dns/operations/zone-delete.md).
1. [Delete the service account](../../iam/operations/sa/delete.md).