Create ClusterIssuer (Let's Encrypt)

Create Let's Encrypt prod ClusterIssuer with HTTP-01 solver

kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
EOF

tool: cert-manager16 commands
tags: cert-manager tls letsencrypt acme

More cert-manager commands

Force certificate renewal

cmctl renew <name> -n <ns>

Trigger immediate reissue without waiting for the renewal window; watch a new CertificateRequest spawn
Certificate status playbook

cmctl status certificate <name> -n <ns>

End-to-end view: Certificate, Request, Order, Challenge and the exact ACME failure reason
Inspect issued secret contents

cmctl inspect secret <name> -n <ns>

Decode the tls.crt and show issuer, SANs, validity without manual openssl x509 piping
DNS01 Route53 ClusterIssuer

kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-dns spec: acme: server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: letsencrypt-dns solvers: - dns01: route53: region: us-east-1 hostedZoneID: <id> EOF

DNS01 issuer for wildcard certs; IRSA/secret must grant route53 change-record perms
Stuck ACME challenges

kubectl get challenges -A -o wide && kubectl describe challenge -n <ns> <name>

List pending validations and read the propagation/self-check error blocking issuance

all 16 cert-manager commands