cert-manager

Kubernetes-native TLS certificate lifecycle management. Automates issuance, renewal, and rotation from private CAs.

Debugging Workflow

When certificates fail, debug the resource chain in order:

Certificate → CertificateRequest → Issuer/ClusterIssuer

First commands to run:

kubectl get certificate,certificaterequest,issuer,clusterissuer -A
kubectl describe certificate <name> -n <namespace>

For detailed debugging steps, see references/troubleshooting-workflow.md.