Requests TLS certificate
DevOps & Tooling / Knowledge library
cert-manager
certificate issuance renewal and issuer integration
Why learn cert-manager?
Useful for managing certificate lifecycles declaratively. Issuer credentials, validation challenges, and renewal failures still require monitoring.
Where it came from
cert-manager automates certificate issuance and renewal in Kubernetes through certificate and issuer resources. It integrates with supported certificate authorities.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Distinguish Certificate and Issuer resources.
- Use a test issuer in a disposable namespace.
- Inspect certificate readiness conditions.
- Explain how a validation challenge is completed.
- Test renewal monitoring without exposing private keys.
Documentation and sources
- Official project documentation (cert-manager.io)
Catalog research notes
- Research snapshot: September 9, 2026. This entry summarizes the linked primary documentation; it does not assert a latest release version.
Connect the ideas
Built on
Explore next
Real World Example
Automated TLS Lifecycle for Global Retail Logistics
A global logistics provider managing thousands of microservices across distributed Kubernetes clusters.
The business problem
Manual certificate rotation leads to frequent service outages and security compliance failures when certificates expire unexpectedly.
How this topic solves it
Implementing cert-manager to automate the issuance and renewal of TLS certificates via integration with HashiCorp Vault, ensuring that every workload receives a valid, short-lived certificate without manual intervention.
- Install cert-manager into the cluster using Helm to manage the lifecycle of Certificate resources.
- Configure an Issuer or ClusterIssuer resource to define the connection parameters for the HashiCorp Vault PKI backend.
- Define a Certificate resource for each microservice, specifying the common name, DNS names, and the reference to the Issuer.
- Mount the resulting Kubernetes Secret containing the TLS key and certificate into the application Pods for secure communication.
This diagram illustrates the lifecycle of a certificate from request to storage.
Orchestrates issuance
Signs the certificate
Stores TLS assets
- Microservice Pod → creates Certificate resource → cert-manager
- cert-manager → requests signing → HashiCorp Vault
- HashiCorp Vault → returns signed certificate → cert-manager
- cert-manager → writes key and cert → Kubernetes Secret
Expected business outcome
The organization achieves continuous service availability and consistent security posture by eliminating human error in the certificate renewal process.
Limitations and checks
The standard Certificate resource stores private keys in Kubernetes Secrets, which are accessible to users with read access to the namespace; this can be checked by auditing RBAC permissions on Secret objects.