apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt
  namespace: opensearch
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Try using this chain because the default one is expired
    preferredChain: "ISRG Root X1"
    # Email address used for ACME registration
    email: me@example.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: my-acme-key
    # Enable the DNS-01 challenge provider
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
      dns01:
        route53:
          accessKeyID: <mykey>
          region: us-east-2
          secretAccessKeySecretRef:
            key: secret-access-key
            name: route53-credentials-secret

curl: (60) SSL certificate problem: unable to get local issuer certificate

openssl s_client -connect my-server.example.com

CONNECTED(00000005)
---
Certificate chain
 0 s:/CN=my-server.example.com
   i:/C=US/O=(STAGING) Let's Encrypt/CN=(STAGING) Artificial Apricot R3
 1 s:/C=US/O=(STAGING) Let's Encrypt/CN=(STAGING) Artificial Apricot R3
   i:/C=US/O=(STAGING) Internet Security Research Group/CN=(STAGING) Pretend Pear X1
 2 s:/C=US/O=(STAGING) Internet Security Research Group/CN=(STAGING) Pretend Pear X1
   i:/C=US/O=(STAGING) Internet Security Research Group/CN=(STAGING) Doctored Durian Root CA X3