In Red Hat OpenShift Container Platform (OCP), the cert-manager Operator for Red Hat OpenShift automates the management, issuance, and renewal of X.509 certificates for applications, ingress routes, and internal cluster services.

It is based on the upstream open-source cert-manager project, natively integrated and fully supported by Red Hat.

1. Key Concepts & Architecture

cert-manager introduces several custom resources (CRDs) into the cluster to represent certificate issuers and requested certificates:

Plaintext

 ┌────────────────────────────────────────────────────────┐
 │                     Certificates                       │
 │      (CRD defining domain, secretName, issuerRef)      │
 └───────────────────────────┬────────────────────────────┘
                             │ Requests Cert
                             ▼
 ┌────────────────────────────────────────────────────────┐
 │                 Issuer / ClusterIssuer                 │
 │ (Let's Encrypt, HashiCorp Vault, Active Directory, CA) │
 └───────────────────────────┬────────────────────────────┘
                             │ Provisions & Renews
                             ▼
 ┌────────────────────────────────────────────────────────┐
 │                   Kubernetes Secret                    │
 │               (tls.crt, tls.key, ca.crt)               │
 └────────────────────────────────────────────────────────┘

• Issuer: Scoped to a single namespace. Issues certificates only within that namespace.
• ClusterIssuer: Cluster-scoped resource. Issues certificates across all namespaces (ideal for cluster-wide ingress routes or wildcards).
• Certificate: Defines the desired X.509 certificate (DNS names, IP SANs, renewal thresholds, duration) and references an Issuer or ClusterIssuer.
• Supported Backends: Let’s Encrypt (ACME HTTP-01 / DNS-01), HashiCorp Vault, Venafi, Private CA (PKI), and Self-Signed issuers.

2. Installing the cert-manager Operator

Install the official Red Hat operator via the OpenShift CLI:

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: openshift-cert-manager-operator
  namespace: openshift-cert-manager-operator
spec:
  channel: stable-v1
  name: openshift-cert-manager-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

Verify operator deployment:

oc get pods -n openshift-cert-manager

3. Practical Example: ACME Let’s Encrypt ClusterIssuer

Here is a declarative setup using Let’s Encrypt (HTTP-01 challenge via OpenShift Ingress) to automatically issue public TLS certificates.

Step A: Create the ClusterIssuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: sysadmin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            ingressClassName: openshift-default

Step B: Request a Certificate for an Application

YAML

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: app-example-cert
  namespace: my-app-prod
spec:
  secretName: app-example-tls # Secret where the generated tls.crt/tls.key will be stored
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - app.example.com
  duration: 2160h # 90 days
  renewBefore: 360h # Automatically renew 15 days prior to expiration

4. Integrating cert-manager with OpenShift Routes

OpenShift Route objects can natively reference the TLS secret managed by cert-manager using the OpenShift Ingress Operator annotation integration:

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: my-app-route
  namespace: my-app-prod
  annotations:
    # OpenShift automatically requests a cert from cert-manager for this route
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  host: app.example.com
  to:
    kind: Service
    name: my-app-service
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

5. Useful Debugging & Verification Commands

• Check Status of Issuers:
  oc get clusterissuers,issuers -A
• Check Issued Certificates & Expiration Dates:
  oc get certificates -A
• Describe Certificate Request Status (Useful for failing challenges):
  oc describe certificaterequest -n <namespace> oc get challenges -n <namespace>
• View cert-manager Controller Logs:oc logs -n openshift-cert-manager deployment/cert-manager -f