{"id":3245,"date":"2026-07-14T10:08:20","date_gmt":"2026-07-14T10:08:20","guid":{"rendered":"https:\/\/certera.com\/kb\/?p=3245"},"modified":"2026-07-10T10:09:08","modified_gmt":"2026-07-10T10:09:08","slug":"how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager","status":"publish","type":"post","link":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/","title":{"rendered":"How to Install an ACME SSL Certificate in Kubernetes Using Cert-Manager?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Summary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When your cluster is handling traffic over an unsecured TLS channel, all traffic sent between your users and services is readable in plain text. If you are running NGINX Ingress or Traefik without automation for certificate management, then you are one expired certificate away from a production outage. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cert-manager <\/strong>eliminates this problem forever, automatically issuing, renewing and binding ingress to Kubernetes without human interaction.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Do You Need Before You Start?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are five things you must have before you can get a single command to run successfully.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A working <strong>Kubernetes Cluster installed <\/strong>with Kubernetes v1.23 or above.<\/li>\n\n\n\n<li>The <strong>kubectl utility<\/strong> is set up and logged in to your cluster.<\/li>\n\n\n\n<li><strong>One of the two most popular options <\/strong>is to use an ingress controller such as NGINX Ingress or Traefik.<\/li>\n\n\n\n<li><strong>Your domain&#8217;s DNS A record is resolved <\/strong>to your ingress controller&#8217;s public address<\/li>\n\n\n\n<li>An <strong>EAB Credentials<\/strong>: ACME Directory URL, an EAB Key Identifier (KID), and an EAB HMAC Key<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These are required to make cert-manager&#8217;s HTTP-01 challenge succeed. It will fail silently. Before proceeding, check DNS propagation using <strong>dig or nslookup.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps to Configure cert-manager &amp; ACME service in Kubernetes<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Install Cert-Manager in Kubernetes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install cert-manager using Helm. It is the recommended method for production clusters because it gives you version control, upgrade paths, and CRD management in one command.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Run these four commands in sequence:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl create namespace cert-manager\n\n<em>helm repo add jetstack https:\/\/charts.jetstack.io<\/em>\n\n<em>helm repo update<\/em>\n\n<em>helm install cert-manager jetstack\/cert-manager \\\n--namespace cert-manager \\\n--version v1.14.4 \\\n--set installCRDs=true<\/em><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>After installation, confirm all three pods are running:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl get pods -n cert-manager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>You must see exactly three pods:<\/strong> cert-manager, cert-manager-webhook, and cert-manager-cainjector. <\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">If any pod is in CrashLoopBackOff or Pending, the webhook will block certificate issuance downstream. Fix pod health before moving forward.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a Kubernetes Secret for EAB Credentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">External Account Binding (EAB) credentials are used to verify cert-manager to your Commercial CA DigiCert, Sectigo, or GlobalSign. These credentials need to be stored in a Kubernetes Secret, and not hardcoded in YAML manifests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Make a secret using this one-line command. To create a new secret, use the following command:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl create secret generic acme-eab-secret \\\n--namespace cert-manager \\\n--from-literal=eab-kid=\"YOUR_EAB_KID\" \\\n--from-literal=eab-hmac-key=\"YOUR_EAB_HMAC_KEY\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Substitute your own E<strong>AB_KID and YOUR_EAB_HMAC_KEY with your CA&#8217;s values<\/strong> from their dashboard. Whitespace from a browser or PDF is not valid for HMAC. You should first copy it into a plain text editor, then paste it back in.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Define a ClusterIssuer or Issuer<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A ClusterIssuer is the cert-manager resource that connects your cluster to your CA&#8217;s ACME endpoint. It works across all namespaces. Use it for shared infrastructure. A regular Issuer is scoped to a single namespace, and it is for tenant isolation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Create a file named clusterissuer.yaml with this configuration:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: cert-manager.io\/v1\nkind: ClusterIssuer\nmetadata:\n  name: acme-issuer\nspec:\n  acme:\n    server: https:\/\/your.acme-server.com\/v2\/DV\n    email: admin@yourdomain.com\n    privateKeySecretRef:\n      name: acme-private-key\n    externalAccountBinding:\n      keyID: YOUR_EAB_KID\n      keySecretRef:\n        name: acme-eab-secret\n        key: eab-hmac-key\n    solvers:\n    - http01:\n        ingress:\n          class: nginx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Apply it:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl apply -f clusterissuer.yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Three fields require your direct attention: <strong>server<\/strong> is your CA&#8217;s ACME directory URL, <strong>email<\/strong> is the address that receives expiry warnings, and <strong>ingress.class<\/strong> must match your actual ingress controller. <\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">Use <strong>\u201ctraefik\u201d<\/strong> for Traefik, and &#8220;<strong>nginx<\/strong>&#8221; for NGINX Ingress Controller. A mismatched ingress class is the single most common reason HTTP-01 challenges fail.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Certificate Resource<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A Certificate resource tells cert-manager exactly which domains to secure and where to store the resulting TLS secret. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Create a file named certificate.yaml:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: cert-manager.io\/v1\nkind: Certificate\nmetadata:\n  name: my-ssl-cert\n  namespace: default\nspec:\n  secretName: my-ssl-cert-tls\n  issuerRef:\n    name: acme-issuer\n    kind: ClusterIssuer\n  commonName: yourdomain.com\n  dnsNames:\n  - yourdomain.com\n  - www.yourdomain.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Apply it:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl apply -f certificate.yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"quote-section\">Cert-manager immediately contacts your CA, serves the ACME challenge token through your ingress, and, upon validation, stores the signed certificate as a Kubernetes TLS secret named <strong>my-ssl-cert-tls<\/strong>. <\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">This entire process takes under 60 seconds on a correctly configured cluster.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Reference the Certificate in Your Ingress<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The ingress resource is where TLS termination actually happens. <strong>Update your ingress YAML to reference the TLS secret cert-manager created:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: networking.k8s.io\/v1\nkind: Ingress\nmetadata:\n  name: my-ingress\n  namespace: default\n  annotations:\n    cert-manager.io\/cluster-issuer: acme-issuer\nspec:\n  tls:\n  - hosts:\n    - yourdomain.com\n    - www.yourdomain.com\n    secretName: my-ssl-cert-tls\n  rules:\n  - host: yourdomain.com\n    http:\n      paths:\n      - path: \/\n        pathType: Prefix\n        backend:\n          service:\n            name: your-service\n            port:\n              number: 80<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Apply it:<\/strong> <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl apply -f ingress.yaml<\/code><\/pre>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">The annotation <strong>cert-manager.io\/cluster-issuer:<\/strong> acme-issuer is what triggers automatic certificate management. Without it, cert-manager ignores this ingress entirely. The annotation is the bridge between your ingress and your issuer. Never omit it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Verify Certificate and Auto-Renewal<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now we need to make sure that cert-manager has finished getting the certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Run this command to check if cert-manager completed issuance:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl describe certificate my-cert<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We are looking for the message that says &#8220;<strong>Certificate issued successfully<\/strong>&#8220;.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\"><strong>If we see anything like Issuing, Failed, or Pending<\/strong>, that means the ACME challenge did not finish. In that case, we should first check the logs of the ingress controller and the DNS resolution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>To see when the certificates will be renewed:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl get certificaterequests<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cert-manager will renew the certificates automatically thirty days before they expire. <strong>We do not need to renew the certificates.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we want to test the renewal, <strong>we can force cert-manager to renew the certificate away by running:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl cert-manager renew my-ssl-cert<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This way, cert-manager can renew the certificates without any downtime.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">FAQs<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">Can I use DNS-01 Validation of HTTP-01?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, you can. The DNS-01 validation is used in conjunction with Cert-manager. It supports DNS providers like Cloudflare, AWS Route 53 and Google Cloud DNS. This is very useful when a port is not accessible to the public (<a href=\"https:\/\/certera.com\/blog\/what-is-port-80-everything-to-know-about\/\">80 is the default port<\/a>).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does cert-manager do well in production?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, it is. Cert-manager is being used extensively in production. It <a href=\"https:\/\/certera.com\/automated-ssl-certificates\">automates the management of SSL\/TLS certificates<\/a> for private and public cloud deployments of Kubernetes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I obtain a certificate with ACME on Kubernetes?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, it&#8217;s possible to obtain a certificate with ACME. It should be validated with DNS-01, not HTTP-01 challenges. In order to make it work, your DNS server provider should be able to manage the DNS through APIs. Then, you configure the proper DNS resolver for cert-manager.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With cert-manager, Kubernetes security is simplified by automating the management of certificates: issuance, deployment and renewal. After setup, all your apps continue to be secured with valid TLS certificates without any additional administrative burden or risk of unknown certificates expiring. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a <a href=\"https:\/\/certera.com\/acme-certificates\/sectigo-acme-ssl\">trusted ACME-compatible SSL certificat<\/a>e for your Kubernetes environment, contact us today to order an SSL certificate and receive expert deployment and configuration assistance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary When your cluster is handling traffic over an unsecured TLS channel, all traffic sent between your users and services is readable in plain text. If you are running NGINX Ingress or Traefik without automation for certificate management, then you are one expired certificate away from a production outage. Cert-manager eliminates this problem forever, automatically<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":3253,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[460,458,459,461],"class_list":["post-3245","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-installation","tag-acme-ssl-certificate-in-kubernetes","tag-kubernetes-cert-manager-tutorial","tag-kubernetes-certificate-manager","tag-kubernetes-ssl-certificate-automation","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Setting Up SSL on Kubernetes with Cert-manager &amp; ACME<\/title>\n<meta name=\"description\" content=\"This ACME Kubernetes guide covers cert-manager installation, ClusterIssuer setup, certificate issuance, automatic renewal, and Ingress TLS configuration.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Setting Up SSL on Kubernetes with Cert-manager &amp; ACME\" \/>\n<meta property=\"og:description\" content=\"This ACME Kubernetes guide covers cert-manager installation, ClusterIssuer setup, certificate issuance, automatic renewal, and Ingress TLS configuration.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/\" \/>\n<meta property=\"og:site_name\" content=\"Knowledge Base - Certera.com\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/certeraLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-14T10:08:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/07\/kubernetes-cert-manager-configuration.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"622\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"certerakbdbuser\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:site\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"certerakbdbuser\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/\"},\"author\":{\"name\":\"certerakbdbuser\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/person\\\/c25e1519e333a817f30c805384cba014\"},\"headline\":\"How to Install an ACME SSL Certificate in Kubernetes Using Cert-Manager?\",\"datePublished\":\"2026-07-14T10:08:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/\"},\"wordCount\":955,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/kubernetes-cert-manager-configuration.webp\",\"keywords\":[\"ACME SSL certificate in Kubernetes\",\"kubernetes cert manager tutorial\",\"Kubernetes Certificate Manager\",\"Kubernetes SSL Certificate Automation\"],\"articleSection\":[\"SSL Installation\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/\",\"name\":\"Setting Up SSL on Kubernetes with Cert-manager & ACME\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/kubernetes-cert-manager-configuration.webp\",\"datePublished\":\"2026-07-14T10:08:20+00:00\",\"description\":\"This ACME Kubernetes guide covers cert-manager installation, ClusterIssuer setup, certificate issuance, automatic renewal, and Ingress TLS configuration.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#primaryimage\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/kubernetes-cert-manager-configuration.webp\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/kubernetes-cert-manager-configuration.webp\",\"width\":960,\"height\":622,\"caption\":\"ACME SSL Installation Kubernetes\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/certera.com\\\/kb\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Install an ACME SSL Certificate in Kubernetes Using Cert-Manager?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#website\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/\",\"name\":\"Knowledge Base - Certera.com\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#organization\"},\"alternateName\":\"Certera Knowledgebase\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/certera.com\\\/kb\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#organization\",\"name\":\"Certera\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/brand-certera.svg\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/brand-certera.svg\",\"caption\":\"Certera\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/certeraLLC\\\/\",\"https:\\\/\\\/x.com\\\/certera_llc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/certera-llc\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/person\\\/c25e1519e333a817f30c805384cba014\",\"name\":\"certerakbdbuser\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g\",\"caption\":\"certerakbdbuser\"},\"sameAs\":[\"https:\\\/\\\/certerakb.ssltoolsonline.com\"],\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/author\\\/certerakbdbuser\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Setting Up SSL on Kubernetes with Cert-manager & ACME","description":"This ACME Kubernetes guide covers cert-manager installation, ClusterIssuer setup, certificate issuance, automatic renewal, and Ingress TLS configuration.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/","og_locale":"en_US","og_type":"article","og_title":"Setting Up SSL on Kubernetes with Cert-manager & ACME","og_description":"This ACME Kubernetes guide covers cert-manager installation, ClusterIssuer setup, certificate issuance, automatic renewal, and Ingress TLS configuration.","og_url":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/","og_site_name":"Knowledge Base - Certera.com","article_publisher":"https:\/\/www.facebook.com\/certeraLLC\/","article_published_time":"2026-07-14T10:08:20+00:00","og_image":[{"width":960,"height":622,"url":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/07\/kubernetes-cert-manager-configuration.webp","type":"image\/jpeg"}],"author":"certerakbdbuser","twitter_card":"summary_large_image","twitter_creator":"@certera_llc","twitter_site":"@certera_llc","twitter_misc":{"Written by":"certerakbdbuser","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#article","isPartOf":{"@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/"},"author":{"name":"certerakbdbuser","@id":"https:\/\/certera.com\/kb\/#\/schema\/person\/c25e1519e333a817f30c805384cba014"},"headline":"How to Install an ACME SSL Certificate in Kubernetes Using Cert-Manager?","datePublished":"2026-07-14T10:08:20+00:00","mainEntityOfPage":{"@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/"},"wordCount":955,"commentCount":0,"publisher":{"@id":"https:\/\/certera.com\/kb\/#organization"},"image":{"@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/07\/kubernetes-cert-manager-configuration.webp","keywords":["ACME SSL certificate in Kubernetes","kubernetes cert manager tutorial","Kubernetes Certificate Manager","Kubernetes SSL Certificate Automation"],"articleSection":["SSL Installation"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/","url":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/","name":"Setting Up SSL on Kubernetes with Cert-manager & ACME","isPartOf":{"@id":"https:\/\/certera.com\/kb\/#website"},"primaryImageOfPage":{"@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#primaryimage"},"image":{"@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/07\/kubernetes-cert-manager-configuration.webp","datePublished":"2026-07-14T10:08:20+00:00","description":"This ACME Kubernetes guide covers cert-manager installation, ClusterIssuer setup, certificate issuance, automatic renewal, and Ingress TLS configuration.","breadcrumb":{"@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#primaryimage","url":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/07\/kubernetes-cert-manager-configuration.webp","contentUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/07\/kubernetes-cert-manager-configuration.webp","width":960,"height":622,"caption":"ACME SSL Installation Kubernetes"},{"@type":"BreadcrumbList","@id":"https:\/\/certera.com\/kb\/how-to-install-an-acme-ssl-certificate-in-kubernetes-using-cert-manager\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/certera.com\/kb\/"},{"@type":"ListItem","position":2,"name":"How to Install an ACME SSL Certificate in Kubernetes Using Cert-Manager?"}]},{"@type":"WebSite","@id":"https:\/\/certera.com\/kb\/#website","url":"https:\/\/certera.com\/kb\/","name":"Knowledge Base - Certera.com","description":"","publisher":{"@id":"https:\/\/certera.com\/kb\/#organization"},"alternateName":"Certera Knowledgebase","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/certera.com\/kb\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/certera.com\/kb\/#organization","name":"Certera","url":"https:\/\/certera.com\/kb\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/kb\/#\/schema\/logo\/image\/","url":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2023\/01\/brand-certera.svg","contentUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2023\/01\/brand-certera.svg","caption":"Certera"},"image":{"@id":"https:\/\/certera.com\/kb\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/certeraLLC\/","https:\/\/x.com\/certera_llc","https:\/\/www.linkedin.com\/company\/certera-llc\/"]},{"@type":"Person","@id":"https:\/\/certera.com\/kb\/#\/schema\/person\/c25e1519e333a817f30c805384cba014","name":"certerakbdbuser","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g","caption":"certerakbdbuser"},"sameAs":["https:\/\/certerakb.ssltoolsonline.com"],"url":"https:\/\/certera.com\/kb\/author\/certerakbdbuser\/"}]}},"_links":{"self":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts\/3245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/comments?post=3245"}],"version-history":[{"count":2,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts\/3245\/revisions"}],"predecessor-version":[{"id":3249,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts\/3245\/revisions\/3249"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/media\/3253"}],"wp:attachment":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/media?parent=3245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/categories?post=3245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/tags?post=3245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}