cert-manager review
A focused, free certificate controller for automated TLS across Kubernetes and OpenShift.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
cert-manager is an open-source add-on for Kubernetes and OpenShift that obtains, issues, stores, and renews X.509 certificates. It is designed for cluster operators and platform teams managing TLS and related certificate workflows across workloads, Pods, and Ingress controllers. Its Kubernetes resources include Certificate, Issuer, ClusterIssuer, and CertificateRequest, giving teams a declarative way to define certificate issuance and signing requests within the cluster.
Its strongest area is automated certificate lifecycle management. cert-manager renews certificates before expiration and supports configurable renewal windows and renewal policies. Ingress-based issuance can connect certificate workflows to application routing, while Kubernetes Secrets provide a native storage location for issued certificates and private keys. The project also supports multiple X.509 key usages and extended key usages, with category support spanning TLS, mTLS, S/MIME, and code signing. Integrations include Let's Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI, so teams can use either public or internal certificate authorities.
The trade-off is its narrow deployment focus. cert-manager is self-hosted and built around Kubernetes and OpenShift, so it fits teams already operating those environments rather than organizations seeking a standalone certificate management service. Teams also need to manage the surrounding cluster configuration, issuer resources, Secrets, and Ingress integration themselves. Choose cert-manager when free, open-source automation is a priority and certificate workflows belong inside Kubernetes. Consider a different category of product when you need a platform independent of Kubernetes or a broader certificate-management experience outside cluster operations.
cert-manager pros and cons
- Where it wins
- Automatic renewal before certificates expire
- Works with Let's Encrypt, Vault, CyberArk, and private PKI
- Stores certificates and private keys in Kubernetes Secrets
- Where it doesn't
- Requires a self-hosted Kubernetes or OpenShift environment
- Focused on Kubernetes-based certificate workflows
- Does not provide AI features
cert-manager fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. How we rank.
Last updated · How we research and update