cmctl check API

Verify cert-manager API is ready using the cmctl CLI

cmctl check api
tool
cert-manager16 commands
tags
cert-managertlscmctlcli

More cert-manager commands

  • Create ClusterIssuer (Let's Encrypt)
    kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: admin@example.com privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: nginx EOF

    Create Let's Encrypt prod ClusterIssuer with HTTP-01 solver

  • Force certificate renewal
    cmctl renew <name> -n <ns>

    Trigger immediate reissue without waiting for the renewal window; watch a new CertificateRequest spawn

  • Certificate status playbook
    cmctl status certificate <name> -n <ns>

    End-to-end view: Certificate, Request, Order, Challenge and the exact ACME failure reason

  • Inspect issued secret contents
    cmctl inspect secret <name> -n <ns>

    Decode the tls.crt and show issuer, SANs, validity without manual openssl x509 piping

  • DNS01 Route53 ClusterIssuer
    kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-dns spec: acme: server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: letsencrypt-dns solvers: - dns01: route53: region: us-east-1 hostedZoneID: <id> EOF

    DNS01 issuer for wildcard certs; IRSA/secret must grant route53 change-record perms

all 16 cert-manager commands