Rotate and renew certificates

cert-manager renews certificates automatically before they expire, so a working setup needs no calendar reminders. This page covers how renewal happens, how to monitor it, and how to force or recover one when necessary.

Automatic renewal#

Each Certificate has a renewBefore window. cert-manager renews once the certificate reaches that proximity to expiry, well ahead of the deadline. For a 90-day Let's Encrypt certificate, the default renews it approximately one third of the way before expiry, leaving ample time to retry if a renewal fails. You can shorten the window per Certificate:

		spec:
  renewBefore: 720h # renew 30 days before expiry
	

When cert-manager renews, it writes the new certificate into the same Secret. An ingress controller watching that Secret loads the new certificate and serves it, with no restart and no dropped connections.

flowchart LR
    A[Certificate issued] --> B[cert-manager watches expiry]
    B --> C{Inside renewBefore<br/>window?}
    C -- no --> B
    C -- yes --> D[Request a fresh cert over ACME]
    D --> E{Challenge passed?}
    E -- no --> H[Back off, retry later]
    H --> D
    E -- yes --> F[Write new cert to the same Secret]
    F --> G[Ingress reloads the Secret,<br/>serves the new cert]

Watch a certificate#

		$ kubectl get certificate
NAME                  READY   SECRET                 AGE
app-example-com-tls   True    app-example-com-tls    60d
$ kubectl describe certificate app-example-com-tls
	

The events on the Certificate show the last renewal and any failure. READY: True with a recent renewal event is a healthy certificate.

Force a renewal#

To rotate ahead of schedule, for example after a suspected key exposure, trigger a renewal with the cert-manager CLI:

		$ cmctl renew app-example-com-tls
	

cert-manager requests a fresh certificate and updates the Secret. Do not rotate in a tight loop; each renewal is an actual request against the certificate authority.

Alert before expiry#

Automatic renewal usually just works, but a broken solver (a DNS record removed, an ingress that stopped answering the challenge) can let a certificate drift toward expiry unnoticed. Alert on the certificate's remaining lifetime so a stuck renewal surfaces before it becomes an outage. cert-manager exposes each certificate's expiry as a metric; wire it into your monitoring, and see Platform alert rules for the certificate-expiry rules and the node-level certificates the health daemon reports on.

Where to go next#

• Set up a Let's Encrypt ClusterIssuer
• Install cert-manager
• Platform alert rules