cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.5 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The base images move to Debian 13, which no longer includes the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes crypto/x509 reject certificate chains that pass through the compromised intermediates…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes crypto/x509 reject certificate chains that pass through the compromised intermediates (CVE-2026-111943)…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release updates Go and several dependencies to fix reported security vulnerabilities, and fixes a bug where ingress-shim removed the applyset label from cached Ingress and Gateway objects. All users should upgrade. NoteSecurity scanners still report three golang.org/x/crypto findin…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced V…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics value…
Note⚠️ This is a pre-release. For testing only! For full release notes including breaking changes, upgrade notes, major themes and community credits, see the v1.21 release notes. Changes since v1.21.0-alpha.1 Feature Add certificateRequestMaximumBackoffDuration controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, --certificate-requ…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release fixes a security issue (GHSA-8rvj-mm4h-c258, HIGH) where the default cert-manager-edit aggregate ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly. A user who could create a Challenge referencing a ClusterIssuer could suppl…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release fixes a security issue (GHSA-8rvj-mm4h-c258, HIGH) where the default cert-manager-edit aggregate ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly. A user who could create a Challenge referencing a ClusterIssuer could suppl…
Changes since v1.21.0-alpha.0 Note⚠️ This is a pre-release. For testing only! Feature Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps) Add new controller flag --acme-http01-solver-extra-labels, allowing Helm's global.commonLabels to propagate to all dynamically-create…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade. Changes by Kind Other (Cleanup or Flake) Bump go dependencies with reported vulnerabilities (#8706, @erikgb) Bump go to 1.25.8 to address several reported vulnerabilities (#8628, @SgtCoD…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.2 fixes invalid YAML generated in the Helm chart when both webhook.config and webhook.volumes are defined, and bumps Go to 1.26.2 along with dependencies to address reported vulnerabilities. Changes by Kind Bug or Regression Helm: Fix invalid YAML generated when both webhook.config and…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate parentRef bug when both issuer config and annotations are present (Gateway API). Bug or Regression Fixed duplicate parentRef b…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. ⚠️ This is a pre-release. For testing only! Changes by Kind since v1.20.0 Feature Feat(certificate): adding certificate renewal policies (#8258, @hjoshi123) Promote the CAInjectorMerging feature gate to GA (#8583, @Copilot) Bug or Regression Fixed duplicate parentRef bug when both issuer conf…
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. Changes by Kind Feature Added a set of flags to permit setting NetworkPolicy across all dep…
Changes since v1.20.0-alpha.1 In this release, parentRef override annotations, Azure private DNS zone support, and configurable PEM size limits were added, while an ACME TXT record cleanup issue in CloudDNS and a potential controller panic from malformed DNS responses were fixed. Feature Added parentRef override annotations on the Certificate resource. (#8518, @hjoshi123) Added support for azure p…