<p>I want to customize the certificate validity duration and renewal throughout the cluster. Iguess doing that with ClusterIssuer is feasible. Is there a way to do so ?</p>

<p>For that same you can configure it using the below two field</p>
<pre><code>duration: 2160h # 90d
renewBefore: 360h # 15d
</code></pre>
<p>Things to take care :</p>
<p>The <code>renewBefore</code> and <code>duration</code> fields must be specified using Golang’s <code>time.Time</code> string format, which does not allow the <strong>d</strong> (<strong>days</strong>).</p>
<p>Example certificate</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: example.com
  dnsNames:
  - example.com
  - www.example.com
  uriSANs:
  - spiffe://cluster.local/ns/sandbox/sa/example
  issuerRef:
    name: ca-issuer
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: Issuer
</code></pre>
