<p>I have installed cert manager on a k8s cluster:</p>
<pre><code>helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.5.3 --set installCRDs=true
</code></pre>
<p>My objective is to do mtls communication between micro-services running in same name-space.</p>
<p>For this purpose I have created a ca issuer .i.e..</p>
<pre><code>kubectl get issuer -n sandbox -o yaml
apiVersion: v1
items:
- apiVersion: cert-manager.io/v1
  kind: Issuer
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {&quot;apiVersion&quot;:&quot;cert-manager.io/v1&quot;,&quot;kind&quot;:&quot;Issuer&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;ca-issuer&quot;,&quot;namespace&quot;:&quot;sandbox&quot;},&quot;spec&quot;:{&quot;ca&quot;:{&quot;secretName&quot;:&quot;tls-internal-ca&quot;}}}
    creationTimestamp: &quot;2021-09-16T17:24:58Z&quot;
    generation: 1
    managedFields:
    - apiVersion: cert-manager.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:kubectl.kubernetes.io/last-applied-configuration: {}
        f:spec:
          .: {}
          f:ca:
            .: {}
            f:secretName: {}
      manager: HashiCorp
      operation: Update
      time: &quot;2021-09-16T17:24:58Z&quot;
    - apiVersion: cert-manager.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          .: {}
          f:conditions: {}
      manager: controller
      operation: Update
      time: &quot;2021-09-16T17:24:58Z&quot;
    name: ca-issuer
    namespace: sandbox
    resourceVersion: &quot;3895820&quot;
    selfLink: /apis/cert-manager.io/v1/namespaces/sandbox/issuers/ca-issuer
    uid: 90f0c811-b78d-4346-bb57-68bf607ee468
  spec:
    ca:
      secretName: tls-internal-ca
  status:
    conditions:
      message: Signing CA verified
      observedGeneration: 1
      reason: KeyPairVerified
      status: &quot;True&quot;
      type: Ready
kind: List
metadata:
  resourceVersion: &quot;&quot;
  selfLink: &quot;&quot;
</code></pre>
<p>Using this ca issuer, I have created certificates for my two micro-service .i.e.</p>
<pre><code>kubectl get certificate -n sandbox      
NAME                       READY         SECRET             Age
service1-certificate        True    service1-certificate     3d     
service2-certificate        True    service2-certificate     2d23h
</code></pre>
<p>which is configured as</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  annotations:
    meta.helm.sh/release-name: service1
    meta.helm.sh/release-namespace: sandbox
  creationTimestamp: &quot;2021-09-17T10:20:21Z&quot;
  generation: 1
  labels:
    app.kubernetes.io/managed-by: Helm
  managedFields:
  - apiVersion: cert-manager.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/managed-by: {}
      f:spec:
        .: {}
        f:commonName: {}
        f:dnsNames: {}
        f:duration: {}
        f:issuerRef:
          .: {}
          f:kind: {}
          f:name: {}
        f:renewBefore: {}
        f:secretName: {}
        f:subject:
          .: {}
          f:organizations: {}
        f:usages: {}
    manager: Go-http-client
    operation: Update
    time: &quot;2021-09-17T10:20:21Z&quot;
  - apiVersion: cert-manager.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:spec:
        f:privateKey: {}
      f:status:
        .: {}
        f:conditions: {}
        f:notAfter: {}
        f:notBefore: {}
        f:renewalTime: {}
        f:revision: {}
    manager: controller
    operation: Update
    time: &quot;2021-09-20T05:14:12Z&quot;
  name: service1-certificate
  namespace: sandbox
  resourceVersion: &quot;5177051&quot;
  selfLink: /apis/cert-manager.io/v1/namespaces/sandbox/certificates/service1-certificate
  uid: 0cf1ea65-92a1-4b03-944e-b847de2c80d9
spec:
  commonName: example.com
  dnsNames:
  - service1
  duration: 24h0m0s
  issuerRef:
    kind: Issuer
    name: ca-issuer
  renewBefore: 12h0m0s
  secretName: service1-certificate
  subject:
    organizations:
    - myorg
  usages:
  - client auth
  - server auth
status:
  conditions:
  - lastTransitionTime: &quot;2021-09-20T05:14:13Z&quot;
    message: Certificate is up to date and has not expired
    observedGeneration: 1
    reason: Ready
    status: &quot;True&quot;
    type: Ready
  notAfter: &quot;2021-09-21T05:14:13Z&quot;
  notBefore: &quot;2021-09-20T05:14:13Z&quot;
  renewalTime: &quot;2021-09-20T17:14:13Z&quot;
  revision: 5
</code></pre>
<p>Now as you could see in the configuration I have configured to renew them in 12 hours. However, the secrets created via this custom certificate resource are still aged to two days (the first it was created). I was thinking this tls secret will be renewed via cert manager each day) .i.e.</p>
<pre><code>kubectl get secrets service1-certificate service2-certificate -n sandbox -o wide
NAME                        TYPE                DATA   AGE
service1-certificate        kubernetes.io/tls   3      2d23h
service2-certificate        kubernetes.io/tls   3      3d1h
</code></pre>
<p>Is there is some wrong in my understanding? In the <code>certmangager</code> pod logs I do see some error around renewing .i.e.</p>
<pre><code>I0920 05:14:04.649158       1 trigger_controller.go:181] cert-manager/controller/certificates-trigger &quot;msg&quot;=&quot;Certificate must be re-issued&quot; &quot;key”=“sandbox/service1-certificate&quot; &quot;message&quot;=&quot;Renewing certificate as renewal was scheduled at 2021-09-19 08:24:13 +0000 UTC&quot; &quot;reason&quot;=&quot;Renewing&quot;     
I0920 05:14:04.649235       1 conditions.go:201] Setting lastTransitionTime for Certificate “service1-certificate&quot; condition &quot;Issuing&quot; to 2021-09-20 05:14:04.649227766 +0000 UTC m=+87949.327215532     
I0920 05:14:04.652174       1 trigger_controller.go:181] cert-manager/controller/certificates-trigger &quot;msg&quot;=&quot;Certificate must be re-issued&quot; &quot;key&quot;=&quot;sandbox/service2 &quot;message&quot;=&quot;Renewing certificate as renewal was scheduled at 2021-09-19 10:20:22 +0000 UTC&quot; &quot;reason&quot;=&quot;Renewing&quot;     
I0920 05:14:04.652231       1 conditions.go:201] Setting lastTransitionTime for Certificate “service2-certificate&quot; condition &quot;Issuing&quot; to 2021-09-20 05:14:04.652224302 +0000 UTC m=+87949.330212052     
I0920 05:14:04.671111       1 conditions.go:190] Found status change for Certificate “service2-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:04.671094596 +0000 UTC m=+87949.349082328
I0920 05:14:04.671344       1 conditions.go:190] Found status change for Certificate “service1-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:04.671332206 +0000 UTC m=+87949.349319948          
I0920 05:14:12.703039       1 controller.go:161] cert-manager/controller/certificates-readiness &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox/service2-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service2-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;          
I0920 05:14:12.703896       1 conditions.go:190] Found status change for Certificate “service2-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:12.7038803 +0000 UTC m=+87957.381868045          
I0920 05:14:12.749502       1 controller.go:161] cert-manager/controller/certificates-readiness &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox/service1-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service1-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;          
I0920 05:14:12.750096       1 conditions.go:190] Found status change for Certificate “service1-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:12.750082572 +0000 UTC m=+87957.428070303     
I0920 05:14:13.009032       1 controller.go:161] cert-manager/controller/certificates-key-manager &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key&quot;=&quot;sandbox/service1-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service1-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;     
I0920 05:14:13.117843       1 controller.go:161] cert-manager/controller/certificates-readiness &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox/service2-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service2-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;     
I0920 05:14:13.119366       1 conditions.go:190] Found status change for Certificate “service2-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:13.119351795 +0000 UTC m=+87957.797339520     
I0920 05:14:13.122820       1 controller.go:161] cert-manager/controller/certificates-key-manager &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox\service2-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;     
I0920 05:14:13.123907       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “service2-certificate-t92qh&quot; condition &quot;Approved&quot; to 2021-09-20 05:14:13.123896104 +0000 UTC m=+87957.801883833
I0920 05:14:13.248082       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “service1-certificate-p9stz&quot; condition &quot;Approved&quot; to 2021-09-20 05:14:13.248071551 +0000 UTC m=+87957.926059296
I0920 05:14:13.253488       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “serivce2-certificate-t92qh&quot; condition &quot;Ready&quot; to 2021-09-20 05:14:13.253474153 +0000 UTC m=+87957.931461871
I0920 05:14:13.388001       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “service1-certificate-p9stz&quot; condition &quot;Ready&quot; to 2021-09-20 05:14:13.387983783 +0000 UTC m=+87958.065971525     
</code></pre>

<h2>Short answer</h2>
<p>Based on logs and details from certificate you provided it's safe to say <strong>it's working as expected</strong>.</p>
<p>Pay attention to <code>revision: 5</code> in your certificate, which means that certificate has been renewed 4 times already. If you try to look there now, this will be 6 or 7 because certificate is updated every 12 hours.</p>
<h2>Logs</h2>
<p>First thing which can be really confusing is <code>error messages</code> in <code>cert-manager</code> pod. This is mostly noisy messages which are not really helpful by itself.</p>
<p>See about it here <a href="https://github.com/jetstack/cert-manager/issues/3501#issuecomment-884003519" rel="nofollow noreferrer">Github issue comment</a> and here <a href="https://github.com/jetstack/cert-manager/issues/3667" rel="nofollow noreferrer">github issue 3667</a>.</p>
<p>In case logs are really needed, <code>verbosity level</code> should be increased by setting <code>args</code> to <code>--v=5</code> in the <code>cert-manager</code> deployment. To edit a deployment run following command:</p>
<pre><code>kubectl edit deploy cert-manager -n cert-manager
</code></pre>
<h2>How to check certificate/secret</h2>
<p>When certificate is renewed, secret's and certificate's age are not changed, but content is edited, for instance <code>resourceVersion</code> in <code>secret</code> and <code>revision</code> in certificate.</p>
<p>Below are options to check if certificate was renewed:</p>
<ol>
<li><p>Check this by getting secret in <code>yaml</code> before and after renew:</p>
<pre><code>kubectl get secret example-certificate -o yaml &gt; secret-before
</code></pre>
</li>
</ol>
<p>And then run <code>diff</code> between them. It will be seen that <code>tls.crt</code> as well as <code>resourceVersion</code> is updated.</p>
<ol start="2">
<li><p>Look into certificate <code>revision</code> and <code>dates</code> in status
(I set duration to minimum possible <code>1h</code> and renewBefore <code>55m</code>, so it's updated every 5 minutes):</p>
<pre><code> $ kubectl get cert example-cert -o yaml
 notAfter: &quot;2021-09-21T14:05:24Z&quot;
 notBefore: &quot;2021-09-21T13:05:24Z&quot;
 renewalTime: &quot;2021-09-21T13:10:24Z&quot;
 revision: 7
</code></pre>
</li>
<li><p>Check events in the namespace where certificate/secret are deployed:</p>
<pre><code>$ kubectl get events
117s        Normal   Issuing             certificate/example-cert                The certificate has been successfully issued
117s        Normal   Reused              certificate/example-cert                Reusing private key stored in existing Secret resource &quot;example-staging-certificate&quot;
6m57s       Normal   Issuing             certificate/example-cert                Renewing certificate as renewal was scheduled at 2021-09-21 13:00:24 +0000 UTC
6m57s       Normal   Requested           certificate/example-cert                Created new CertificateRequest resource &quot;example-cert-bs8g6&quot;
117s        Normal   Issuing             certificate/example-cert                Renewing certificate as renewal was scheduled at 2021-09-21 13:05:24 +0000 UTC
117s        Normal   Requested           certificate/example-cert                Created new CertificateRequest resource &quot;example-cert-7x8cf&quot; UTC
</code></pre>
</li>
<li><p>Look at <code>certificaterequests</code>:</p>
<pre><code>$ kubectl get certificaterequests
NAME                 APPROVED   DENIED   READY   ISSUER      REQUESTOR                                         AGE
example-cert-2pxdd   True                True    ca-issuer   system:serviceaccount:cert-manager:cert-manager   14m
example-cert-54zzc   True                True    ca-issuer      system:serviceaccount:cert-manager:cert-manager   4m29s
example-cert-8vjcm   True                True    ca-issuer      system:serviceaccount:cert-manager:cert-manager   9m29s
</code></pre>
</li>
<li><p>Check logs in <code>cert-manager</code> pod to see four stages:</p>
<pre><code>I0921 12:45:24.000726       1 trigger_controller.go:181] cert-manager/controller/certificates-trigger &quot;msg&quot;=&quot;Certificate must be re-issued&quot; &quot;key&quot;=&quot;default/example-cert&quot; &quot;message&quot;=&quot;Renewing certificate as renewal was scheduled at 2021-09-21 12:45:24 +0000 UTC&quot; &quot;reason&quot;=&quot;Renewing&quot;
I0921 12:45:24.000761       1 conditions.go:201] Setting lastTransitionTime for Certificate &quot;example-cert&quot; condition &quot;Issuing&quot; to 2021-09-21 12:45:24.000756621 +0000 UTC m=+72341.194879378
I0921 12:45:24.120503       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest &quot;example-cert-mxvbm&quot; condition &quot;Approved&quot; to 2021-09-21 12:45:24.12049391 +0000 UTC m=+72341.314616684
I0921 12:45:24.154092       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest &quot;example-cert-mxvbm&quot; condition &quot;Ready&quot; to 2021-09-21 12:45:24.154081971 +0000 UTC m=+72341.348204734
</code></pre>
</li>
</ol>
<h2>Note</h2>
<p>Very important that not all <code>issuers</code> support <code>duration</code> and <code>renewBefore</code> flags. E.g. <code>letsencrypt</code> still doesn't work with it and have 90 default days.</p>
<p><a href="https://cert-manager.io/docs/release-notes/release-notes-1.1/#duration" rel="nofollow noreferrer">Refence</a>.</p>
