# A cert-manager HTTP-01 self-check fails with "remote error: tls: handshake failure". Which annotation does the troubleshooting guide suggest?

cert-manager, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/a-cert-manager-http-01-self-check-fails-with-remote-error-tls-handshake-failure-which-annotation-does-the-troubleshooting-guide

- A. cert-manager.io/disable-self-check: "true"
- B. acme.cert-manager.io/http01-insecure: "true"
- C. cert-manager.io/allow-plain-http: "true"
- D. cert-manager.io/issue-temporary-certificate: "true"

**Answer:** cert-manager.io/issue-temporary-certificate: "true"

**Explanation:** The handshake error usually means the ingress controller redirects or serves HTTPS for a host that has no certificate yet. With issue-temporary-certificate, cert-manager first puts a temporary self-signed certificate in the Secret so the ingress controller can serve TLS while the real one is issued. Set it on the Ingress or the Certificate.