<p>I’m having Kubernetes version: v1.25.6+k3s1</p>
<p>cert-manager: 1.11.0</p>
<p>Host: Ubuntu 22.04</p>
<p>I'm creating some certificates with cert-manager and everything looks good, but it turned out it isn't.
The problem is that the certificates are not renewed so secrets will have old certificates on them resulting in application requests failing.</p>
<p>I investigated that. In the beginning I thought it is a problem with cert-manager [they had this problem before] but after continuing to investigate I think the problem is actually something else and that beeing the time difference between my local time [from where I'm using kubectl to deploy things] and kubernetes hosts machine time.</p>
<p>I think the certificates are not renewed because actually they should not based on the hosts machine time.</p>
<p>e.g.:
My local time it is 3PM so I'm creating some certificates that should renewed after 1H.
I'll check the certificates and yes, they should be renewed at 4PM.
But of course, they aren't. I checked the kubernetes host machine local time and it was 2AM [so until 4PM to renew the cert [-5m because the notbefore is -5m] it is a lot, but my certs already expired for hours]</p>
<p>The question is: What is the best approach to deploy things on Kubernetes, using kubectl from another machine, but in this specific example, when creating certificates to not use my local time but kubernetes machine time?</p>
<p>Regards,</p>
<p>L.E.: so I changed the timezone into Kubernetes hosts machine to be same as my local machine, but for some reasons it seems the notBefore is with 2h behind so now doesn't make any sense anymore :-(</p>

Astin Gengo
<p>Cert-manager in Kubernetes will not be affected basically by timezone differences as it uses Coordinated Universal Time (UTC) as the standard timezone for all the processes.</p>
<p>Cert-manager will automatically renew Certificates. It will calculate when to renew a Certificate based on the issued certificate's <code>duration</code> and a <code>renewBefore</code> value.</p>
<p><code>spec.duration</code> and <code>spec.renewBefore</code> fields on a Certificate can be used to specify a certificate's <code>duration</code> and a <code>renewBefore</code> value. Default value for <code>spec.duration</code> is 90 days.The actual duration may be different depending upon the issuers configurations. Minimum value for <code>spec.duration</code> is 1 hour and minimum value for <code>spec.renewBefore</code> is 5 minutes. Also, please note that <code>spec.duration &gt; spec.renewBefore</code>.</p>
<p>Once a certificate has been issued, cert-manager will calculate the renewal time for the Certificate. By default this will be 2/3rd of the issued certificate's duration. If <code>spec.renewBefore</code> has been set, it will be <code>spec.renewBefore</code> amount of time before expiry. Cert-manager will set <code>Certificate status.RenewalTime</code> to the time when the renewal will be attempted.</p>
<p>The above information is derived from the official <a href="https://cert-manager.io/docs/usage/certificate/#renewal" rel="nofollow noreferrer">documentation</a>.</p>
