cert-manager

Best Practices

• Use ClusterIssuer for cluster-wide certificate management across namespaces
• Configure Let's Encrypt staging issuer for testing before switching to production
• Set certificate duration to 90 days (2160h) and renewBefore to at least 15 days (360h)
• Use DNS01 challenge solver for wildcard certificates (*.example.com)
• Configure HTTP01 challenge with correct ingress class for standard single-domain certificates
• Store ACME account key in privateKeySecretRef with a descriptive secret name
• Use ECDSA keys (algorithm: ECDSA, size: 256) for better performance unless RSA compatibility is required
• Specify explicit dnsNames or ipAddresses — avoid relying on commonName alone (deprecated in modern TLS)
• Use separate issuers per environment (staging vs production) to avoid rate limit issues