---
name: openshift-ts-ingress-errdsiss
title: 'Ingress error: ERRDSISS'
description: Troubleshoot Ingress DSISS (Destination Service Invalid Service Selector) errors.
last-updated: 2026-08-12
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/openshift?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Ingress error: ERRDSISS
{: #ts-ingress-errdsiss}
{: troubleshoot}
{: support}

[Virtual Private Cloud]{: tag-vpc} [Classic infrastructure]{: tag-classic-inf} [Satellite]{: tag-satellite}

Troubleshoot Ingress DSISS (Destination Service Invalid Service Selector) errors.
{: shortdesc}


You can use the `ibmcloud oc ingress status-report ignored-errors add` command to add an error to the ignored-errors list. Ignored errors still appear in the output of the `ibmcloud oc ingress status-report get` command, but are ignored when calculating the overall Ingress Status.
{: tip}

When you check the status of your cluster's Ingress components by running the `ibmcloud oc ingress status-report get` command, you see an error similar to the following example.
{: tsSymptoms}

```sh
The subdomain has TLS secret issues (ERRDSISS).
```
{: screen}


Red Hat OpenShift on IBM Cloud generates a TLS certificate for managed domains and creates a TLS secret on the cluster containing the certificate. Normally, the certificate status should be `created` or `deleted`, but the status indicates problems with the certificate or secret generation.
{: tsCauses}

Check the `SSL Cert Status` of your managed domains and, if needed, regenerate them.
{: tsResolve}

1. Get the list of the managed domains using the **`ibmcloud oc nlb-dns ls`** [command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#nlb-dns-ls-cli).
1. Check the `SSL Cert Status` column.

    `creating` or `regenerating` status.
    :   Wait a few hours and check the status again. If the status does not change, ensure that the namespace appearing in the `Secret Namespace` exists.

    `rate_limited` status.
    :   Let's Encrypt refused to generate a new certificate for this domain. This usually happens when the cluster is deleted and recreated with the same name, or the **`ibmcloud oc nlb-dns secret regenerate`** command was invoked multiple times. The rate limit will expire after 7 days (there is no way to manually remove it). Certificate generation will be automatically attempted again after 7 days.

    `not_eligible` status.
    :   The domain must be available in public DNS otherwise certificate generation will never succeed. Make sure that your domain is registered in public DNS and run the **`ibmcloud oc nlb-dns secret regenerate`** to force a new validation.
1. Wait 10-15 minutes, then check if the warning is resolved.
1. If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/support?topic=support-using-avatar&format=markdown). In the case details, be sure to include any relevant log files, error messages, or command outputs.