cert-manager commands

16 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 16 shown

  • Install cert-manager via Helm
    helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true

    Install cert-manager with CRDs into its own namespace

    tls · k8s · helm

  • Check cert-manager pods
    kubectl get pods -n cert-manager

    Verify all cert-manager components are running

    tls · k8s · debug

  • List certificates
    kubectl get certificates -A

    List all Certificate resources across namespaces

    tls · k8s

  • Describe certificate
    kubectl describe certificate my-cert -n default

    Show status and events for a Certificate resource

    tls · k8s · debug

  • List certificate requests
    kubectl get certificaterequests -A

    List all CertificateRequest objects

    tls · k8s

  • Create ClusterIssuer (Let's Encrypt)
    kubectl apply -f clusterissuer-letsencrypt.yaml

    Apply a ClusterIssuer manifest for Let's Encrypt ACME

    tls · letsencrypt · acme

  • Check ClusterIssuers
    kubectl get clusterissuers

    List all ClusterIssuer resources and their ready status

    tls · issuer

  • Manually trigger renewal
    kubectl annotate certificate my-cert cert-manager.io/issueTime="$(date -u +%Y-%m-%dT%H:%M:%SZ)" --overwrite

    Force cert-manager to renew a certificate immediately

    tls · renew

  • View cert-manager logs
    kubectl logs -n cert-manager deploy/cert-manager -f

    Stream logs from the main cert-manager controller

    tls · logs · debug

  • cmctl check API
    cmctl check api

    Verify cert-manager API is ready using the cmctl CLI

    tls · cmctl · cli

  • Create ClusterIssuer (Let's Encrypt)
    kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: admin@example.com privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: nginx EOF

    Create Let's Encrypt prod ClusterIssuer with HTTP-01 solver

    tls · letsencrypt · acme

  • Force certificate renewal
    cmctl renew <name> -n <ns>

    Trigger immediate reissue without waiting for the renewal window; watch a new CertificateRequest spawn

    tls · secrets · k8s

  • Certificate status playbook
    cmctl status certificate <name> -n <ns>

    End-to-end view: Certificate, Request, Order, Challenge and the exact ACME failure reason

    tls · troubleshooting · debug

  • Inspect issued secret contents
    cmctl inspect secret <name> -n <ns>

    Decode the tls.crt and show issuer, SANs, validity without manual openssl x509 piping

    tls · secrets · security

  • DNS01 Route53 ClusterIssuer
    kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-dns spec: acme: server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: letsencrypt-dns solvers: - dns01: route53: region: us-east-1 hostedZoneID: <id> EOF

    DNS01 issuer for wildcard certs; IRSA/secret must grant route53 change-record perms

    tls · dns · cloud

  • Stuck ACME challenges
    kubectl get challenges -A -o wide && kubectl describe challenge -n <ns> <name>

    List pending validations and read the propagation/self-check error blocking issuance

    tls · dns · troubleshooting