Skip to content
SPECIFICTION
Get listed

cert-manager

cert-manager.io

Free plan LinuxAPISelf-hosted
Visit cert-manager.io
Spec score 8.0 #10 of 31 in Certificate Management Software

What it is

cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.

Spec sheet

Purpose
cert-manager obtains X.509 certificates from public and private issuers, keeps them valid and up to date, and attempts renewal before expiry.Read 7 Oct 2026 · cert-manager.io
Integrations
Satellite projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager.Read 7 Oct 2026 · cert-manager.io
Support
Palo Alto Networks offers commercial support and FIPS builds as part of its Long Term Support offering.Read 7 Oct 2026 · cert-manager.io
Certificate authorities
The documentation lists Let's Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI among certificate authority options.Read 7 Oct 2026 · cert-manager.io
Installation
Installation options include static manifests applied with kubectl, Helm, and continuous deployment tools such as Flux and Argo CD.Read 7 Oct 2026 · cert-manager.io
mTLS
Private PKI issuers can be used to secure pod-to-pod communication with mTLS.Read 7 Oct 2026 · cert-manager.io
Release support
The open-source project does not maintain LTS releases and supports each release at least until the second subsequent version is released.Read 7 Oct 2026 · cert-manager.io
Security caveat
The hardening guide says default Helm chart values prioritize ease of installation and backward compatibility over production-grade hardened security practices.Read 7 Oct 2026 · cert-manager.io
Security guidance
The project publishes an end-user threat model and hardening guide covering secrets, RBAC, networking, Kubernetes configuration, and related projects.Read 7 Oct 2026 · cert-manager.io
Supported workloads
The project describes certificate use cases for web-facing and internal workloads on Kubernetes and OpenShift.Read 7 Oct 2026 · cert-manager.io
Target users
The product is described for Kubernetes and OpenShift workloads that need managed certificates for public-facing or internal services.Read 7 Oct 2026 · cert-manager.io
TLS automation
It automates certificate issuance and renewal to secure Kubernetes Ingress with TLS.Read 7 Oct 2026 · cert-manager.io
Trust bundles
trust-manager distributes X.509 trust bundles across Kubernetes and OpenShift clusters and can be used independently of cert-manager.Read 7 Oct 2026 · cert-manager.io

Plans and prices

Open source cert-manager Free Free X.509 certificate management for Kubernetes and OpenShift workloads Read 7 Oct 2026 · cert-manager.io

Every cert-manager plan and price →

Strong points and limits

Strong points

  • Free open-source certificate management
  • Automated issuance and renewal
  • Public and private certificate authorities
  • Kubernetes and OpenShift support
  • Multiple deployment methods

Limits

  • Default Helm values are not production-hardened
  • Open-source project does not maintain LTS releases
  • No free trial is offered

Who it suits

cert-manager suits teams running Kubernetes or OpenShift workloads that need managed certificates for public-facing or internal services. It is available through API, Linux, and self-hosted deployments.

Verdict

cert-manager provides automated X.509 lifecycle management for Kubernetes and OpenShift, including Ingress TLS and internal mTLS. Operators should review the hardening guidance and plan around its release-support policy.

Where Specifiction places it

Alternatives to cert-managerAll alternatives →