From da9ba64b07175017c6b16e13f27c8bfc031877e7 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Thu, 23 Apr 2026 18:35:08 +0200 Subject: [PATCH] Persist cleared provisioning error before HTTP challenge When DNS and CAA checks pass, ProvisioningError is set to nil but was only persisted later alongside the challenge data. If GetHTTPChallenge then failed, the update was never reached, leaving stale DNS/CAA error messages visible to the user. Signed-off-by: Bryan Frimin --- pkg/certmanager/provisioner.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/certmanager/provisioner.go b/pkg/certmanager/provisioner.go index d287e6c76..1900db185 100644 --- a/pkg/certmanager/provisioner.go +++ b/pkg/certmanager/provisioner.go @@ -369,6 +369,9 @@ func (p *Provisioner) provisionDomainCertificate( } domain.ProvisioningError = nil + if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil { + return fmt.Errorf("cannot clear provisioning error: %w", err) + } p.logger.InfoCtx(ctx, "DNS configuration verified, initiating HTTP challenge for domain", log.String("domain", domain.Domain))