View cert-manager logs

Stream logs from the main cert-manager controller

kubectl logs -n cert-manager deploy/cert-manager -f

More cert-manager commands

cmctl check API

cmctl check api

Verify cert-manager API is ready using the cmctl CLI
Create ClusterIssuer (Let's Encrypt)

kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: admin@example.com privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: nginx EOF

Create Let's Encrypt prod ClusterIssuer with HTTP-01 solver
Force certificate renewal

cmctl renew <name> -n <ns>

Trigger immediate reissue without waiting for the renewal window; watch a new CertificateRequest spawn
Certificate status playbook

cmctl status certificate <name> -n <ns>

End-to-end view: Certificate, Request, Order, Challenge and the exact ACME failure reason
Inspect issued secret contents

cmctl inspect secret <name> -n <ns>

Decode the tls.crt and show issuer, SANs, validity without manual openssl x509 piping