chore: clarify isCertValid

Author: Kamil Przybyl

pkg/alb/ingress/alb_spec.go

@@ -351,8 +351,10 @@ func (r *IngressClassReconciler) cleanupCerts(ctx context.Context, ingressClass
 	return nil
 }
 
-// isCertValid checks if the certificate chain is complete. It is used for checking if
-// the cert-manager's ACME challenge is completed, or if it's sill ongoing.
+// isCertValid checks if the certificate chain is complete (contains both a leaf and intermediate CAs).
+// This is necessary because the Certificates API only validates the match between 
+// the public and private key but it does not reject incomplete chains. Since the API lacks an update call,
+// we must wait for the full chain to avoid locking the ALB into an incomplete certificate.
 func isCertValid(secret *corev1.Secret) (bool, error) {
 	tlsCert := secret.Data["tls.crt"]
 	if tlsCert == nil {
@@ -380,7 +382,8 @@ func isCertValid(secret *corev1.Secret) (bool, error) {
 		certs = append(certs, cert)
 	}
 
-	// If there are multiple certificates, it means the chain is likely complete
+    // A valid, trusted chain must contain at least 2 certificates: 
+    // the leaf (domain) and at least one intermediate CA.
 	return len(certs) > 1, nil
 }