SSL Certificate renewal automation with cert-manager - Revision history

Ppapa at 00:58, 9 November 2026

2026-11-09T00:58:28Z

← Older revision		Revision as of 00:58, 9 November 2026
Line 29:		Line 29:
	acme:		acme:
	email: '''me@mydomain.com'''		email: '''me@mydomain.com'''
	server: '''https://ca_url.com'''		server: '''<nowiki>https://ca_url.com</nowiki>'''
	externalAccountBinding:		externalAccountBinding:
	keyID: '''YOUR_KID_VALUE'''		keyID: '''YOUR_KID_VALUE'''

Ppapa at 00:04, 6 November 2026

2026-11-06T00:04:28Z

← Older revision		Revision as of 00:04, 6 November 2026
Line 59:		Line 59:
	commonName: '''mydomain.com'''		commonName: '''mydomain.com'''
	dnsNames:		dnsNames:
	- san.mydomain.com		- '''san.mydomain.com'''
	- san2.mydomain.com		- '''san2.mydomain.com'''

			'''NOTE:''' Obviously, the '''dnsNames''' section is only relevant for multi-domain certificates with SANs

	7. Create the SSL certificate secret		7. Create the SSL certificate secret

	kubectl apply -f '''name_of_file_from_step_6.yaml'''		kubectl apply -f '''name_of_file_from_step_6.yaml'''

Ppapa at 00:02, 6 November 2026

2026-11-06T00:02:52Z

← Older revision		Revision as of 00:02, 6 November 2026
Line 50:		Line 50:
	kind: Certificate		kind: Certificate
	metadata:		metadata:
	name: '''some_metadata_name~~```~~		name: '''some_metadata_name'''
	namespace: '''namespace_where_certificate_should_live'''		namespace: '''namespace_where_certificate_should_live'''
	spec:		spec:
	secretName: ~~```~~some_name_for_the_tle_cert_secret'''		secretName: '''some_name_for_the_tle_cert_secret'''
	issuerRef:		issuerRef:
	name: '''NAME_OF_MY_ISSUER'''		name: '''NAME_OF_MY_ISSUER'''

Ppapa: Created page with "1. Download the GPG key so you can verify the signature of the helm chart curl -LO https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg 2. Install cert-manager with helm: helm install \ cert-manager oci://quay.io/jetstack/charts/cert-manager \ --version v1.21.3 \ --namespace cert-manager \ --create-namespace \ --verify \ --keyring ./cert-manager-keyring-2021-09-20-1020CF3C033D4F35B..."

2026-11-05T05:28:09Z

Created page with "1. Download the GPG key so you can verify the signature of the helm chart curl -LO https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg 2. Install cert-manager with helm: helm install \ cert-manager oci://quay.io/jetstack/charts/cert-manager \ --version v1.21.3 \ --namespace cert-manager \ --create-namespace \ --verify \ --keyring ./cert-manager-keyring-2021-09-20-1020CF3C033D4F35B..."

New page

1. Download the GPG key so you can verify the signature of the helm chart

curl -LO https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg

2. Install cert-manager with helm:

helm install \
cert-manager oci://quay.io/jetstack/charts/cert-manager \
--version v1.21.3 \
--namespace cert-manager \
--create-namespace \
--verify \
--keyring ./cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg \
--set crds.enabled=true

3. Create a secret for the HMAC value

kubectl create secret generic '''NAME_OF_SECRET''' --from-literal secret='''HMAC_VALUE''' -n cert-manager

'''NOTE:''' You should keep your HMAC secret, so maybe wrap this in a script!

4. Create a YAML file containing the details for your issuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: '''NAME_OF_MY_ISSUER'''
spec:
acme:
email: '''me@mydomain.com'''
server: '''https://ca_url.com'''
externalAccountBinding:
keyID: '''YOUR_KID_VALUE'''
keySecretRef:
name: '''NAME_OF_SECRET'''
key: secret
privateKeySecretRef:
name: '''SOME_NAME_FOR_PRIVATE_KEY_REF'''
solvers:

Set you own values for the parameters in '''bold'''.

5. Create the issuer

kubectl apply -f '''file_from_step_4.yaml'''

6. Create a YAML file containing the details for your certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: '''some_metadata_name```
namespace: '''namespace_where_certificate_should_live'''
spec:
secretName: ```some_name_for_the_tle_cert_secret'''
issuerRef:
name: '''NAME_OF_MY_ISSUER'''
kind: ClusterIssuer
commonName: '''mydomain.com'''
dnsNames:
- san.mydomain.com
- san2.mydomain.com

7. Create the SSL certificate secret

kubectl apply -f '''name_of_file_from_step_6.yaml'''