cert-manager-troubleshooting

Troubleshoot cert-manager TLS issues by tracing the resource chain from Certificate and CertificateRequest to Order, Challenge, and Issuer resources to pinpoint failures. Check issuer health and validate ACME interactions to identify the root cause of certificate errors.

An Issuer or ClusterIssuer is not Ready due to failed ACME server interactions, misconfigured CA details, or invalid Kubernetes RBAC permissions. Validate issuer health and verify access to the cluster's ACME server or CA to resolve the readiness failure.

Fix failed ACME challenges for expired certificates by checking the status of Challenge resources and verifying ACME server connectivity. Inspect certificate secrets and renewal flows across namespaces to ensure operations teams restore TLS availability.

Diagnose cert-manager errors by requiring kubectl access to cert-manager components alongside correct Kubernetes RBAC permissions to read Certificate, CertificateRequest, Order, and Challenge resources. Access to the cluster's ACME server or CA is also required.

The best way to trace a failing CertificateRequest is to follow the diagnosis workflow from Certificate to Challenge and Issuer to identify the root cause. Check certificate secrets and renewal behavior across namespaces to locate the deepest failing component.