Cert-Manager and the AKS Certificate Provisioning Lifecycle

Cert-manager automates certificate provisioning by integrating with ACME certificate authorities including Let’s Encrypt. When an ingress resource with a this controller annotation is applied to the cluster, this controller detects the annotation, creates a Certificate resource, initiates an ACME challenge to validate domain ownership, and, if validation succeeds, stores the resulting certificate as a the TLS secret that the ingress controller uses for TLS termination.

The AKS certificate provisioning flow has several points where failures can occur silently from the perspective of the ingress controller.

The ingress controller expects a TLS secret to exist at the name specified in the ingress resource.

If cert-manager has not yet created that secret, whether because provisioning is still in progress or because it has failed entirely, the ingress controller reports an error about a missing secret rather than a this controller error. This indirect failure reporting is why many this certificate issues are misdiagnosed initially: the error visible at the ingress controller level obscures the actual failure occurring at the this controller layer. For ICANIO DevOps engineers working with enterprise clients in the USA and UK, the standard first diagnostic step for any this certificate issue is to check this controller Certificate resources directly rather than attempting to diagnose from ingress controller error messages alone.

Diagnosing AKS Certificate Issues: The Systematic Approach

A systematic diagnostic flow begins by verifying whether the expected TLS secret exists, then examining the Certificate resource status for error conditions, and finally tracing through the CertificateRequest and ACME challenge layers to identify the specific failure point. The kubectl describe command on the Certificate resource is the single most important diagnostic step because it surfaces the actual error message from the certificate authority, which is usually the precise information needed to identify the root cause.

Step 1: Check Whether the Secret Exists

The first step in any cert-manager troubleshooting sequence is confirming whether the Kubernetes TLS secret referenced in the ingress resource actually exists in the namespace. If the secret is absent, certificate provisioning has either not started or failed. Confirming the secret’s absence before examining this controller resources establishes the correct diagnostic starting point and rules out the possibility that the ingress controller is referencing the wrong secret name.

Step 2: Examine the Certificate Resource

The Certificate resource contains the current provisioning status and any error conditions. Checking whether the Certificate is in READY: True or READY: False state, and running kubectl describe on the Certificate resource to retrieve the status conditions, provides the specific error message from the certificate authority. For AKS certificate issues caused by Let’s Encrypt rate limits, the status condition will contain a 429 rateLimited error with specific information about when the rate limit window resets. This this certificate diagnostic step eliminates the need to guess about root causes because the error message is explicit.

Step 3: Check CertificateRequest and Challenge Resources

If the Certificate resource shows an error but the message is not specific enough, checking CertificateRequest resources and ACME Challenge resources provides additional layers of detail. CertificateRequest resources show the status of individual certificate issuance attempts. Challenge resources show the status of ACME domain validation challenges, which fail separately from the rate limiting scenario and indicate DNS validation issues or ClusterIssuer misconfiguration rather than Let’s Encrypt rate limits. ICANIO’s certificate troubleshooting runbooks for enterprise clients in Germany and Australia include all three diagnostic layers as standard steps, ensuring that the root cause is identified correctly before any remediation action is taken.

Let’s Encrypt Rate Limit: Why It Happens

Let’s Encrypt enforces a duplicate certificate limit of five certificates per exact set of domain identifiers per rolling seven-day window. This Let’s Encrypt rate limit is designed to prevent abuse of the free certificate service and to ensure it remains available to all users. In production environments where a domain is provisioned once and certificates are renewed automatically, this rate limit is never encountered. In development and staging environments, it is a common obstacle because the same domain names are reused across multiple cluster rebuilds, configuration iterations, and debugging attempts.

Development environments are particularly vulnerable to hitting this rate limit for several reasons. Rapid iteration during configuration debugging causes multiple certificate requests for the same domain within short time windows.

Cluster rebuilds during infrastructure testing remove existing cluster certificate state and trigger fresh certificate requests for domains that may have already consumed most of their weekly quota.

Namespace recreation removes existing Kubernetes TLS secrets, prompting this controller to request new certificates even when the domain’s rate limit quota is almost exhausted. For ICANIO DevOps engineers working on certificate management for clients in Malaysia and the UK, the the rate limit is one of the first possibilities considered when this controller is not creating secrets in a development or staging environment, because the symptom, a missing the TLS secret with no obvious error in the ingress controller logs, is identical to several other this controller failure modes.

Solutions for Let’s Encrypt Rate Limit Issues

Wait for the Rate Limit Window to Reset

The Let’s Encrypt rate limit resets automatically when the oldest certificate in the seven-day rolling window ages out. The error message returned when the rate limit is hit includes the exact timestamp at which the limit will reset. For production environments where domain names cannot be changed and the certificate must use the production Let’s Encrypt issuer, waiting is the appropriate remediation once the rate limit has been triggered.

The reset is automatic and requires no intervention. For ICANIO clients in the USA and Australia managing production this certificate environments, monitoring the Certificate resource status and configuring an alert for when the READY condition changes to True provides the earliest possible notification of when the rate limit has cleared.

Switch to Let’s Encrypt Staging

For development and testing environments, switching to use the Let’s Encrypt staging environment eliminates the rate limit concern entirely. The staging environment uses a separate ACME endpoint with a much higher rate limit of 30,000 certificates per week and is specifically designed for development and testing use.

The staging endpoint issues certificates signed by a staging certificate authority rather than a trusted production CA, which means browsers will show a certificate warning for staging-issued certificates, making them unsuitable for user-facing deployments. For internal development environments and automated testing pipelines, this distinction is immaterial. The this controller ClusterIssuer configuration for staging requires only the ACME server URL to be changed from the production Let’s Encrypt endpoint to the staging endpoint.

Use a Different Subdomain

Because rate limits apply to the exact set of domain identifiers, changing the subdomain for the affected environment immediately bypasses the rate limit without waiting for the seven-day window to reset. Using environment-specific subdomains as a standard practice, such as api-dev, api-staging, and api as separate subdomains for development, staging, and production respectively, prevents rate limit collisions between environments entirely.

This pattern also provides clearer separation between environments in DNS and access control, which has operational benefits beyond certificate provisioning management.

Create a Temporary Self-Signed Certificate

When the application must be accessible immediately while waiting for the Let’s Encrypt rate limit to reset, a self-signed Kubernetes TLS secret can be created manually to unblock the ingress controller. Generating a self-signed certificate with openssl and creating a Kubernetes secret from the resulting certificate and key files creates a functional TLS secret that the ingress controller and Application Gateway Ingress Controller can use. The self-signed certificate will produce browser warnings for any user accessing the application directly, but it unblocks the application from the provisioning failure while the production certificate flow is restored.

Certificate Provisioning: Prevention Strategies

The most effective approach to AKS certificate management is preventing Let’s Encrypt rate limit issues from occurring rather than responding to them after deployment is blocked. Environment separation through distinct subdomains for development, staging, and production environments prevents rate limit collisions. Certificate backup before cluster operations preserves existing Kubernetes TLS secrets so they can be restored after a cluster rebuild without triggering new certificate provisioning requests. Proactive certificate health monitoring that checks the READY status of all Certificate resources in the cluster and alerts before expiry or provisioning failure keeps the engineering team ahead of certificate issues rather than responding to them reactively.

For ICANIO clients in Germany and the USA managing multi-environment AKS deployments, a a configuration standard that routes development and staging environments to the Let’s Encrypt staging issuer by default, with explicit opt-in required to use the production issuer, prevents the most common path to rate limit exhaustion. This standard is implemented as a ClusterIssuer naming convention that makes the issuer type visible in the ingress annotation, making it easy to audit which environments are consuming production Let’s Encrypt quota and which are not. ICANIO includes provisioning governance standards in all enterprise certificate management programs for enterprise clients, treating this controller configuration consistency as an operational reliability requirement rather than a configuration preference.

Cert-Manager Best Practices for Enterprise AKS Deployments

Beyond resolving active certificate provisioning failures, establishing cert-manager configuration standards that prevent failures from occurring is the operational investment that most benefits enterprise AKS deployments at scale. Several practices consistently reduce the frequency and operational cost of certificate issues across enterprise environments.

Using a dedicated cert-manager namespace with clearly defined RBAC permissions separates certificate management operations from application workloads and makes the controller logs easier to search during incident diagnosis. Versioning ClusterIssuer and Certificate resource manifests in source control ensures that the controller configuration changes are reviewed before application and can be rolled back if they introduce provisioning failures. Configuring certificate expiry monitoring through Prometheus metrics that the controller exposes natively provides advance warning of certificates approaching expiry before they cause application failures. For ICANIO clients in Germany and Australia operating regulated environments with compliance audit requirements, certificate expiry monitoring and the controller configuration version history are not optional enhancements but documented operational requirements.

Separating staging and production into distinct ClusterIssuer resources with clear naming conventions prevents the most common path to rate limit exhaustion in development environments. When engineers can see from the ingress annotation which certificate authority is being used for each environment, the configuration intent is explicit and the risk of accidentally consuming production rate limit quota in a development environment is significantly reduced. ICANIO implements this ClusterIssuer naming convention as a standard component of every AKS certificate management engagement for clients across the USA, UK, Germany, Australia, and Malaysia, alongside certificate configuration review checklists that catch common mistakes before they reach production.

The operational discipline of treating cert-manager as a first-class component of the cluster infrastructure, rather than a configuration detail that is set up once and forgotten, is what separates AKS certificate management programs that run smoothly from those that periodically create unplanned deployment blocks. Certificate resources in Kubernetes have expiry dates. The provisioning process that created them can fail without generating user-visible errors if no monitoring is in place. Tracking Certificate resource status alongside application health metrics provides the operational visibility needed to address AKS certificate issues before they affect production deployments.

For ICANIO clients across the USA, UK, Germany, Australia, and Malaysia, certificate governance standards are documented in the same infrastructure-as-code repositories as the ClusterIssuer and ingress resources they govern,

Ensuring that certificate management configuration is reviewed alongside application configuration changes rather than maintained as a separate undocumented operational concern. ICANIO provides infrastructure-as-code templates, documentation, and onboarding runbooks for cert-manager deployments that support rapid onboarding for engineering teams new to Kubernetes certificate management, reducing the time from cluster provisioning to production-ready TLS configuration, and ensuring that operational teams are fully equipped to diagnose and resolve AKS certificate issues independently without requiring external support for the common failure modes that arise in active development and staging environments, and with the confidence to implement preventative governance that keeps certificate issues from affecting future deployments.

Kubernetes certificate management is an area where the gap between a cluster that works and one that is operationally reliable is determined by the governance and monitoring practices built around the automation tools rather than the tools themselves. Cert-manager eliminates the manual effort of certificate provisioning and renewal. What it does not eliminate is the need for operational visibility into whether that automation is functioning correctly.

Organisations that instrument certificate management with expiry monitoring, Certificate resource status alerting, and ClusterIssuer health checks alongside their application monitoring get consistent operational value from the automation. Those that treat certificate automation as a set-and-forget installation encounter the provisioning failures described in this guide periodically, under the time pressure of a blocked deployment, rather than as a managed, anticipated event during normal operations.

Frequently Asked Questions

Why is cert-manager not creating a Kubernetes TLS secret?

The most common reasons cert-manager is not creating a Kubernetes TLS secret are: a Let’s Encrypt rate limit error blocking the ACME certificate request, a DNS validation failure in the ACME challenge, a misconfigured ClusterIssuer, or a cert-manager controller error. Run kubectl describe certificate on the Certificate resource in the relevant namespace to retrieve the exact error message. This diagnostic step provides the specific failure reason rather than requiring guesswork from indirect error messages at the ingress controller layer.

What is the Let’s Encrypt rate limit for duplicate certificates?

Let’s Encrypt enforces a duplicate certificate limit of five certificates per exact set of domain identifiers per rolling seven-day window. When the rate limit is hit, new certificate requests for the same domain return a 429 rateLimited error. The limit resets automatically as certificates age out of the seven-day window, at the exact time specified in the cert-manager error message. Switching to the staging environment or changing the domain name are the immediate remediation options when the production Let’s Encrypt rate limit has been exhausted.

How do you switch cert-manager to Let’s Encrypt staging?

Create a ClusterIssuer that uses the Let’s Encrypt staging ACME server URL instead of the production URL, then update the cert-manager annotation on the ingress resource to reference the staging ClusterIssuer name. The staging environment has a rate limit of 30,000 certificates per week and is designed for development and testing environments where the browser certificate warning from staging-issued certificates is acceptable. For ICANIO clients managing AKS certificate environments across multiple regions, staging ClusterIssuers are deployed to all non-production clusters as a certificate provisioning governance standard.

How do you create a self-signed Kubernetes TLS secret?

Generate a self-signed certificate and key using openssl with the x509 flag, specifying the domain name in the CN field. Then create a Kubernetes secret of type kubernetes.io/tls using the generated certificate and key files with kubectl create secret tls. This creates a functioning Kubernetes TLS secret that unblocks the ingress controller and AGIC immediately while the cert-manager certificate provisioning process is restored, at the cost of a browser certificate warning for direct user access to the application.