Kubernetes Certificate Management with cert-manager
Kubernetes certificate management is the practice of issuing, renewing, and revoking the TLS certificates that secure a Kubernetes cluster and its workloads. cert-manager is the CNCF-graduated tool that automates this inside the cluster.
Kubernetes relies on TLS certificates for its control plane and for securing workload traffic, and managing them by hand does not scale. cert-manager, a CNCF graduated project, adds certificates and issuers as native Kubernetes resources and automatically requests and renews certificates from sources like Let’s Encrypt, Vault, or a private CA, reducing outages from expired certificates.
Key Takeaways
- Kubernetes uses TLS certificates for the control plane and for securing service-to-service traffic.
- cert-manager is the de facto tool for in-cluster certificate automation and graduated in the CNCF in November 2024. The CNCF reports it is deployed in 86 percent of new production clusters.
- It adds Certificate and Issuer resources to Kubernetes and renews certificates automatically before expiry.
- It issues from many sources: ACME (Let’s Encrypt), HashiCorp Vault, AWS Private CA, Google CAS, Venafi, and private CAs.
- For policy and visibility across clusters, cert-manager pairs with a central certificate management platform.
Why Kubernetes Needs Certificate Management
Kubernetes is built on TLS. Its control plane and its workloads depend on certificates to authenticate and encrypt traffic, and clusters can contain hundreds of short-lived components. Managing those certificates by hand does not scale, and an expired certificate can break the cluster or take a service offline. This is the same certificate management challenge seen elsewhere, intensified by Kubernetes scale and churn.
Certificates in a Kubernetes Cluster
Certificates appear in two main places. The control plane uses them so components such as the API server, kubelets, and etcd can authenticate to one another. Workloads use them to secure service-to-service traffic, frequently with mutual TLS (mTLS) so both sides of a connection verify each other. Both areas need reliable, automated issuance and renewal.
What Is cert-manager?
cert-manager is the de facto tool for automating certificates inside Kubernetes. It is an open-source project that graduated in the Cloud Native Computing Foundation (CNCF) in November 2024, marking it as mature and widely adopted; the CNCF reports that 86 percent of new production clusters deploy cert-manager as standard practice. While it is most often used for TLS and mTLS, cert-manager manages X.509 certificates generally, making certificate issuance and renewal a native, declarative part of the cluster.
How cert-manager Works
cert-manager adds custom resources and controllers that handle certificates automatically:
- Issuer / ClusterIssuer: Defines a source of certificates, such as Let’s Encrypt, Vault, or a private CA.
- Certificate: Declares the certificate you want; cert-manager obtains and stores it as a Kubernetes secret.
- Controllers: Watch these resources and automatically renew certificates before they expire.
Because renewal is automatic and happens ahead of expiry, cert-manager removes a common source of outages and manual toil.
cert-manager Issuers
| Issuer | Use |
|---|---|
| ACME (Let’s Encrypt) | Free, automated public certificates for internet-facing endpoints. |
| HashiCorp Vault | Internal certificates issued from a Vault PKI backend. |
| AWS Private CA / Google CAS | Certificates issued from managed cloud CA services. |
| Private CA | Workload certificates issued from your own certificate authority. |
| Venafi and others | Integration with enterprise certificate authorities and platforms. |
Best Practices for Kubernetes Certificate Management
- Automate issuance and renewal with cert-manager rather than handling certificates manually.
- Use short-lived certificates and let cert-manager rotate them frequently.
- Issue internal workload certificates from a private CA you control, and public certificates from a public CA.
- Protect private keys and high-value CA keys, ideally with a hardware security module.
- Maintain central visibility across all clusters so no certificate is untracked.
cert-manager and Enterprise PKI
cert-manager is excellent at in-cluster automation, but it does not by itself give an organization central policy and a single inventory across many clusters and non-Kubernetes systems. That governance gap is filled by an enterprise certificate management platform that integrates with cert-manager. See what a certificate authority is for the trust model behind the certificates cert-manager issues.
How Encryption Consulting Helps
CertSecure Manager provides the enterprise layer above cert-manager: a single inventory, consistent policy, and lifecycle control across every cluster, server, and cloud. Encryption Consulting’s PKI Services design the private CAs that issue your workload certificates, backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
cert-manager is an open-source, CNCF-graduated tool that automates TLS certificate management inside Kubernetes. It adds Certificate and Issuer resources to the cluster and automatically requests, renews, and rotates certificates from sources such as Let’s Encrypt, HashiCorp Vault, or a private CA, reducing the manual work and outages associated with expiring certificates.
Yes. cert-manager is free and open source, maintained as a graduated project under the Cloud Native Computing Foundation (CNCF). It is one of the most widely used CNCF projects. Organizations may still pay for the certificate authorities it integrates with, or for enterprise PKI and support, but cert-manager itself carries no license cost.
Kubernetes uses TLS certificates extensively. The control plane components, such as the API server, kubelets, and etcd, authenticate to each other with certificates. Workloads also use certificates to secure service-to-service traffic, often with mutual TLS. Because there are many short-lived components, certificate issuance and renewal need to be automated.
Yes. cert-manager supports many issuers, including private certificate authorities, HashiCorp Vault, Venafi, and ACME providers like Let’s Encrypt. This lets organizations issue internal workload certificates from their own PKI while using public CAs for internet-facing endpoints, all managed through the same cert-manager resources in the cluster.
cert-manager automates certificates inside a Kubernetes cluster. An enterprise certificate management platform provides visibility, policy, and lifecycle control across all environments, clusters, servers, cloud, and devices. The two are complementary: cert-manager handles in-cluster automation, while a platform such as CertSecure Manager gives central governance and a single inventory across the whole estate.
Govern Certificates Across Every Cluster
Ready to add enterprise control on top of cert-manager? See CertSecure Manager in action, or learn what certificate management is.
Every Layer of Cryptography.
One Team to Secure It.
See how Encryption Consulting secures what your enterprise depends on, from assessment through deployment.
Request a Demo
