Certificate status playbook

End-to-end view: Certificate, Request, Order, Challenge and the exact ACME failure reason

cmctl status certificate <name> -n <ns>
tool
cert-manager16 commands
tags
cert-managertlstroubleshootingdebug

More cert-manager commands

  • Inspect issued secret contents
    cmctl inspect secret <name> -n <ns>

    Decode the tls.crt and show issuer, SANs, validity without manual openssl x509 piping

  • DNS01 Route53 ClusterIssuer
    kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-dns spec: acme: server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: letsencrypt-dns solvers: - dns01: route53: region: us-east-1 hostedZoneID: <id> EOF

    DNS01 issuer for wildcard certs; IRSA/secret must grant route53 change-record perms

  • Stuck ACME challenges
    kubectl get challenges -A -o wide && kubectl describe challenge -n <ns> <name>

    List pending validations and read the propagation/self-check error blocking issuance

  • Install cert-manager via Helm
    helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true

    Install cert-manager with CRDs into its own namespace

  • Check cert-manager pods
    kubectl get pods -n cert-manager

    Verify all cert-manager components are running

all 16 cert-manager commands