cert-manager — Automated X.509 Certificate Management for Kubernetes

What it is

cert-manager is a cloud-native Kubernetes controller that automates the issuance, renewal, and rotation of X.509 TLS certificates. It integrates with certificate authorities like Let's Encrypt, HashiCorp Vault, Venafi, and any ACME-compatible issuer. Certificates are managed through Kubernetes custom resources, making TLS configuration declarative and version-controlled.

The tool targets platform engineers and DevOps teams who manage HTTPS endpoints on Kubernetes and want to eliminate manual certificate management.

How it saves time or tokens

Without cert-manager, teams manually generate certificates, track expiration dates, and coordinate renewal across services. cert-manager automates the entire lifecycle: it requests certificates when Ingress resources are created, renews them before expiration, and stores them as Kubernetes Secrets. This eliminates certificate-related outages caused by forgotten renewals and reduces the operational overhead of TLS management to zero ongoing effort.

How to use

1. Install cert-manager with Helm:

helm repo add jetstack https://charts.jetstack.io && helm repo update
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.enabled=true

1. Create a ClusterIssuer for Let's Encrypt:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

1. Annotate your Ingress to request a certificate:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls

Example

# Request a certificate directly via Certificate resource
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: api-cert
  namespace: production
spec:
  secretName: api-tls

  renewBefore: 360h  # renew 15 days before expiry
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - api.example.com
    - api-v2.example.com

Related on TokRepo

• DevOps tools directory -- Infrastructure automation and CI/CD tools
• Security tools -- Certificate and security management solutions

Common pitfalls

• Using the Let's Encrypt staging server for testing but forgetting to switch to production; staging certificates are not trusted by browsers
• DNS-01 challenges require cloud provider credentials with DNS write access; missing IAM permissions cause silent validation failures
• Rate limits on Let's Encrypt production (50 certificates per registered domain per week) can block high-volume issuance