# cert-manager/cert-manager

Automatically provision and manage TLS certificates in Kubernetes

Repository: https://github.com/cert-manager/cert-manager
Canonical: https://ross.abutalabs.com/products/cert-manager
Homepage: https://cert-manager.io
Language: Go
License: Apache-2.0
License Family: permissive
Topics: kubernetes, letsencrypt, tls, certificate, crd, hacktoberfest
Last push: 2026-08-26T16:14:19+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 95, longevity 100
- inputs: {"age_days": 3388, "days_push": 7, "days_rel": 35, "gap_med": 8.0, "n_releases_24m": 37}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 14052, forks 2438 (observed 2026-08-28T04:11:05.402550+00:00)

## What it is
cert-manager is a Kubernetes controller that adds Certificate and Issuer resource types to clusters and automates obtaining, renewing, and using X.509 TLS certificates. It supports issuers such as Let's Encrypt (ACME), HashiCorp Vault, CyberArk Certificate Manager, and local private PKI, storing certificates in Kubernetes Secrets or delivering them via CSI drivers.

## Use cases
- automatically provision TLS certificates for Kubernetes Ingress with Let's Encrypt
- renew certificates before they expire without manual toil
- secure pod-to-pod communication with mTLS using a private CA
- issue certificates from HashiCorp Vault or CyberArk Certificate Manager
- manage certificates as Kubernetes resources with declarative YAML
- serve certificates to workloads via CSI driver without storing keys in Secrets
- enable HTTPS on web services running in EKS, GKE, or AKS

## When to choose
- you run workloads on Kubernetes or OpenShift and need automated TLS certificate lifecycle management
- you want Let's Encrypt/ACME certificates issued and renewed automatically for Ingress resources
- you need a private in-cluster PKI for mTLS between services
- you want certificates managed declaratively as CRDs

## When to avoid
- you are not running Kubernetes or OpenShift
- you need certificates for a single standalone server where a simple ACME client like certbot suffices
- you require a full web UI for certificate management rather than Kubernetes resources

## Facets
- artifact type: service
- maturity: stable
- function: security, deployment, infrastructure-as-code, configuration-management
- domain: security, cloud-computing, self-hosted
- platform: cloud, self-hosted, go
- tags: tls-certificates, letsencrypt, acme, x509, kubernetes-operator, cncf, certificate-renewal, mtls, private-pki, devops, containers, kubernetes, docker

## Member repositories
- cert-manager/cert-manager (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:05.402550+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:12:50.657681+00:00, confidence not recorded.
  - readme: https://github.com/cert-manager/cert-manager (fetched 2026-08-28T04:11:05.402550+00:00, sha 47587ecd1fca)
  - homepage: https://cert-manager.io (fetched 2026-08-29T08:06:42.151610+00:00, sha e6f2673d1e42)
  - site_page: https://cert-manager.io/docs (fetched 2026-08-29T08:06:42.154094+00:00, sha c3efcb0ad546)
  - site_page: https://cert-manager.io/docs/getting-started (fetched 2026-08-29T08:06:42.155750+00:00, sha e34a79a16c5f)
- Data as of 2026-08-30T08:39:29.467469+00:00.