A cert-manager HTTP-01 self-check fails with "remote error: tls: handshake failure". Which annotation does the troubleshooting guide suggest?

Answer: cert-manager.io/issue-temporary-certificate: "true"

Explanation

The handshake error usually means the ingress controller redirects or serves HTTPS for a host that has no certificate yet. With issue-temporary-certificate, cert-manager first puts a temporary self-signed certificate in the Secret so the ingress controller can serve TLS while the real one is issued. Set it on the Ingress or the Certificate.