cert-manager requests TLS certificates, stores them in Secrets, and renews them before they expire, so your ingress always has a valid certificate without requiring you to track expiry dates. Syself Autopilot does not provide it; you install it yourself as a normal workload.

## Install and verify

<Steps>

<Step>Install the chart with its CRDs</Step>

Install cert-manager and its custom resources into a dedicated namespace:

```console
$ helm repo add jetstack https://charts.jetstack.io
$ helm repo update
$ helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.enabled=true
```

For an ingress that must remain available through node drains, run more than one controller replica and spread them across nodes, the same availability pattern that every platform workload requires.

<Step>Verify the webhook is healthy</Step>

cert-manager runs an admission webhook that validates every issuer and `Certificate` you create, and nothing functions until it is ready. Check that its deployments are available before you create an issuer:

```console
$ kubectl get pods -n cert-manager
NAME                          READY   STATUS    RESTARTS   AGE
cert-manager-...              1/1     Running   0          2m
cert-manager-cainjector-...   1/1     Running   0          2m
cert-manager-webhook-...      1/1     Running   0          2m
```

If a `Certificate` you create later remains without events, check the webhook first.

</Steps>

## Issuer or ClusterIssuer

cert-manager reads two kinds of issuer, and the difference is scope:

- An **`Issuer`** is namespaced: it issues certificates only in its own namespace. Use it to keep one tenant's certificate authority configuration inside that tenant's namespace.
- A **`ClusterIssuer`** is cluster-wide: any namespace can reference it. Use it for a shared Let's Encrypt setup that every application draws on.

Most clusters start with one `ClusterIssuer`; see [Set up a Let's Encrypt ClusterIssuer](/docs/hetzner/apalla/network/dns-certs/lets-encrypt-clusterissuer).

<Callout type="tip" title="Prefer not to run it yourself?">
cert-manager, a `ClusterIssuer`, and DNS wiring are a small but real operational responsibility. Syself can set this up for you and keep it running, from a one-time setup to a fully managed arrangement. Contact [contact@syself.com](mailto:contact@syself.com).
</Callout>

> [!NOTE]
> When you upgrade cert-manager, upgrade its CRDs to match the chart version. A chart running against older CRDs is a common cause of certificates that silently stop reconciling.

## Where to go next

- [Set up a Let's Encrypt ClusterIssuer](/docs/hetzner/apalla/network/dns-certs/lets-encrypt-clusterissuer)
- [Rotate and renew certificates](/docs/hetzner/apalla/network/dns-certs/certificate-rotation-and-renewal)
- [Security on Syself Autopilot](/docs/hetzner/apalla/concepts/ownership/security-model)