- Home
- Public Key Infrastructure Software
- cert-manager
cert-manager
What it is
cert-manager is a free, open-source project for obtaining X.509 certificates from public and private issuers, keeping them valid and attempting renewal before expiry. It automates certificate issuance and renewal for Kubernetes Ingress TLS and can use private PKI issuers for pod-to-pod mutual TLS. The project describes use with web-facing and internal workloads on Kubernetes and OpenShift. Listed certificate authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager and private PKI. Installation can use static manifests with kubectl, Helm, Flux or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe and trust-manager, which distributes trust bundles across clusters and can run independently. Documentation includes a threat model and hardening guidance. Palo Alto Networks offers commercial support and FIPS builds through Long Term Support, while the open-source project does not maintain LTS releases.
For and against
For
- Free open-source certificate management
- Automatic issuance and renewal attempts
- Public and private issuer options
- Kubernetes and OpenShift workload support
- kubectl, Helm and deployment-tool installation
Against
- No free trial is offered
- Open-source releases have no LTS maintenance
- Default Helm values are not production-hardened
The verdict
cert-manager focuses on automated X.509 certificate lifecycle management for Kubernetes and OpenShift. Its issuer choices and installation methods are broad, but production hardening requires attention to the project’s security guidance.
Who it suits
It suits teams running Kubernetes or OpenShift workloads that need managed certificates for public-facing or internal services. It is relevant when automated issuance, renewal or private PKI mTLS is required.
Plans and prices
Open source cert-manager
X.509 certificate management for Kubernetes and OpenShift workloads
Read 7 Oct 2026 · cert-manager.io
On the record
- Certificate authorities
- The documentation lists Let's Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI among certificate authority options.cert-manager.io · read 7 Oct 2026
- Installation
- Installation options include static manifests applied with kubectl, Helm, and continuous deployment tools such as Flux and Argo CD.cert-manager.io · read 7 Oct 2026
- Integrations
- Satellite projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager.cert-manager.io · read 7 Oct 2026
- mTLS
- Private PKI issuers can be used to secure pod-to-pod communication with mTLS.cert-manager.io · read 7 Oct 2026
- Purpose
- cert-manager obtains X.509 certificates from public and private issuers, keeps them valid and up to date, and attempts renewal before expiry.cert-manager.io · read 7 Oct 2026
- Release support
- The open-source project does not maintain LTS releases and supports each release at least until the second subsequent version is released.cert-manager.io · read 7 Oct 2026
- Security caveat
- The hardening guide says default Helm chart values prioritize ease of installation and backward compatibility over production-grade hardened security practices.cert-manager.io · read 7 Oct 2026
- Security guidance
- The project publishes an end-user threat model and hardening guide covering secrets, RBAC, networking, Kubernetes configuration, and related projects.cert-manager.io · read 7 Oct 2026
- Support
- Palo Alto Networks offers commercial support and FIPS builds as part of its Long Term Support offering.cert-manager.io · read 7 Oct 2026
- Supported workloads
- The project describes certificate use cases for web-facing and internal workloads on Kubernetes and OpenShift.cert-manager.io · read 7 Oct 2026
- Target users
- The product is described for Kubernetes and OpenShift workloads that need managed certificates for public-facing or internal services.cert-manager.io · read 7 Oct 2026
- TLS automation
- It automates certificate issuance and renewal to secure Kubernetes Ingress with TLS.cert-manager.io · read 7 Oct 2026
- Trust bundles
- trust-manager distributes X.509 trust bundles across Kubernetes and OpenShift clusters and can be used independently of cert-manager.cert-manager.io · read 7 Oct 2026
