CertManagerCertificateExpiringSoon

A certificate managed by cert-manager is getting close to its expiry date and has not been renewed.


Severity	warning, critical
Source	cert-manager controller `/metrics` (v1.x)
Key metrics	`certmanager_certificate_expiration_timestamp_seconds`, `certmanager_certificate_renewal_timestamp_seconds`

What it means

cert-manager renews certificates well before they expire (by default when a third of the lifetime remains, which for a 90-day Let’s Encrypt certificate is about 30 days). If a certificate is inside the last few weeks, renewal has been failing silently for a while. The warning tier fires with a few weeks left; critical fires when only days remain.

When it expires, clients see TLS errors on the ingress, webhook or internal service using that Secret.

Common causes

ACME HTTP-01 challenges failing: the ingress class changed, a redirect or auth layer intercepts /.well-known/acme-challenge/, or DNS points elsewhere.
DNS-01 solver credentials expired or lack permissions on the zone.
Let’s Encrypt rate limits after repeated failed attempts.
The Issuer or ClusterIssuer is not ready (bad secret, revoked account key, private CA unreachable).
cert-manager itself is not running, or the Certificate was edited so its renewBefore is wrong.

First checks

List certificates by days remaining:

sort((certmanager_certificate_expiration_timestamp_seconds - time()) / 86400)

Get a summary of the whole chain for the certificate:
```
cmctl status certificate <name> -n <namespace>
```

Walk the resources manually if you do not have cmctl:

kubectl -n <namespace> describe certificate <name>
kubectl -n <namespace> get certificaterequest,order,challenge
kubectl -n <namespace> describe challenge <challenge>

Check the issuer:
```
kubectl get clusterissuer,issuer -A
```

Read controller logs for this certificate:

kubectl -n cert-manager logs deploy/cert-manager --tail=300 | grep "<name>"

Fixing it

Fix the failure the Challenge or CertificateRequest reports (open the HTTP-01 path, update DNS credentials, repair the issuer), then trigger an immediate attempt with cmctl renew <name> -n <namespace>. If you are close to expiry and hitting rate limits, switch temporarily to another issuer or ACME provider.

CertManagerCertificateNotReady: usually fires first, when issuance fails.
BlackboxSslCertificateWillExpireSoon: the same expiry as seen from outside.
KubeletServerCertificateExpiration: kubelet certificates are not managed by cert-manager.