---
title: "cert-manager for Kubernetes | Hostman Docs"
description: "Learn how to install and use cert-manager in Kubernetes to automate SSL/TLS certificate issuance and renewal with Let’s Encrypt. Step-by-step guide for configuring ClusterIssuer, Ingress TLS, and securing services with HTTPS."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

`cert-manager` is an extension for Kubernetes that automates the issuance and renewal of certificates. It allows you to obtain certificates from Let's Encrypt and other certificate authorities (CAs) or use internal root certificates. `cert-manager` simplifies certificate management by automatically renewing them before expiration and ensuring secure encryption for services within the cluster. It integrates with Ingress controllers and supports various domain verification methods, making it a convenient tool for automating certificate management in Kubernetes.

## Installation

To install cert-manager:

1.  Go to the **Kubernetes** section and click on the cluster.
2.  Navigate to the **Addons** section and select **cert-manager**.
3.  Click **Install** and wait for the process to complete.

To verify the installation, run the following command:

```shell
kubectl get pods -n cert-manager
```

All pods in the `cert-manager` namespace should have the status `Running`.

## Usage

To enable cert-manager to issue certificates, you need to create a `ClusterIssuer` object, which manages certificates at the cluster level.

Example manifest:

```yml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: email@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
```

Here:

-   `email` – Your email address, required for certificate issuance. Let's Encrypt will send notifications to this address.
-   `server` – The URL of Let's Encrypt or another certificate authority.
-   `privateKeySecretRef` – The secret that stores the private key.
-   `solvers.http01.ingress.class` – The method for verifying domain ownership via HTTP, using the Nginx Ingress controller in this case.

If you're using a different Ingress controller, replace `nginx` with the appropriate value. For example, for Traefik:

```yml
solvers:
  - http01:
      ingress:
        class: traefik
```

## Example Usage of cert-manager

Let's consider an example where `cert-manager` is used with resources from our [Nginx Ingress](https://hostman.com/docs/kubernetes/addons/nginx-ingress/) setup.

If you followed our guide, you have already set up:

-   Three deployments
-   Nginx Ingress
-   A LoadBalancer

Your services are accessible via:

-   `http://ingress1.example.com/service1`
-   `http://ingress1.example.com/service2`
-   `http://ingress2.example.com/`

Now we need to define a `ClusterIssuer` in a file named `cluster-issuer.yaml`:

```yml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: email@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
```

Apply the manifest:

```shell
kubectl apply -f cluster-issuer.yaml
```

Next, you need to update the `Ingress` resource. Modify the existing Ingress manifest by adding an annotation for `cert-manager` and a `tls` section.

Updated `ingress.yaml`:

```yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  namespace: ingress-example
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  rules:
  - host: ingress1.example.com
    http:
      paths:
      - path: /service1
        pathType: Prefix
        backend:
          service:
            name: service1
            port:
              number: 80
      - path: /service2
        pathType: Prefix
        backend:
          service:
            name: service2
            port:
              number: 80
  tls:
  - hosts:
    - ingress1.example.com
    secretName: ingress-tls
```

Changes in this manifest:

1.  Added the annotation `cert-manager.io/cluster-issuer: letsencrypt-prod` to instruct cert-manager to use the created `ClusterIssuer`.
    
2.  Added the `tls` section, specifying the domains for which cert-manager should issue certificates and the secret (`ingress-tls`) where they will be stored.
    

Apply the updated manifest:

```shell
kubectl apply -f ingress.yaml
```

After a short period, cert-manager will issue the certificates and store them in the `ingress-tls` secret. To check the certificates, use:

```shell
kubectl get secret ingress-tls -n ingress-example -o yaml
```

If successful, the secret should contain `tls.crt` and `tls.key`.

Run the following command to test HTTPS connectivity:

```shell
curl -v https://ingress1.example.com/service1
```

If the request completes without errors, the certificates are successfully installed, and the services are running over HTTPS.