cert-manager automates TLS certificate issuance and renewal within Kubernetes, integrating with Let's Encrypt and other certificate authorities — this guide covers setup for automatic HTTPS on cluster-hosted applications.
Why cert-manager Instead of Manual Certificate Management
Similar rationale to How to Set Up Automatic SSL Renewal with Certbot and Let's Encrypt but Kubernetes-native — cert-manager watches for Ingress resources needing TLS and automatically requests, renews, and stores certificates as Kubernetes Secrets, integrated naturally into cluster-native workflows.
Step 1 — Install cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yamlStep 2 — Verify Installation
kubectl get pods -n cert-managerStep 3 — Create a ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: [email protected]
privateKeySecretRef:
name: letsencrypt-prod-key
solvers:
- http01:
ingress:
class: nginxA ClusterIssuer defines how certificates get issued cluster-wide — here using Let's Encrypt's production ACME endpoint with HTTP-01 challenge validation via your Nginx Ingress Controller (see How to Expose Applications with a Kubernetes Ingress Controller (Nginx Ingress)).
Step 4 — Request a Certificate via Ingress Annotation
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: myapp-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
tls:
- hosts:
- yourdomain.com
secretName: myapp-tls
rules:
- host: yourdomain.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: myapp-service
port:
number: 80The annotation tells cert-manager to automatically request and manage a certificate for this Ingress — no manual certificate handling needed once this is properly configured.
Step 5 — Verify Certificate Issuance
kubectl get certificate
kubectl describe certificate myapp-tlsUsing a Staging Issuer for Testing
server: https://acme-staging-v02.api.letsencrypt.org/directorySee the general rate-limiting concern in How to Set Up Automatic SSL Renewal with Certbot and Let's Encrypt — test your configuration against Let's Encrypt's staging environment first (untrusted certificates, but no rate limit risk) before switching to the production issuer.
Using DNS-01 Challenge for Wildcard Certificates
solvers:
- dns01:
cloudflare:
email: [email protected]
apiTokenSecretRef:
name: cloudflare-api-token
key: api-tokenFor wildcard certificates, DNS-01 challenge (requiring DNS provider API access) is necessary, unlike HTTP-01 which only works for specific hostnames.
Monitoring Certificate Renewal
cert-manager automatically handles renewal well before expiration — but monitor certificate status (see How to Monitor SSL Certificate Expiration and Get Alerted Before It's Too Late for the general principle) to catch any renewal failures before they cause an actual outage.
Common Errors
Certificate stuck in "pending" state — check kubectl describe certificate and cert-manager's own pod logs for the specific validation failure; often relates to the HTTP-01 challenge not being reachable (DNS not yet pointing correctly, or Ingress not properly routing the challenge path).
Continue Reading
- How to Expose Applications with a Kubernetes Ingress Controller (Nginx Ingress)
- How to Set Up Automatic SSL Renewal with Certbot and Let's Encrypt
- How to Monitor SSL Certificate Expiration and Get Alerted Before It's Too Late
Browse more articles in Kubernetes & Container Orchestration.
