<p>Why my &quot;Certificate&quot; object and &quot;Ingress&quot; both are creating Certificates ?</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: blog-app-crt
spec:
  secretName: blog-app-crt-sec
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-prod
  commonName: blog.mydomain.com
  dnsNames:
    - blog.mydomain.com




apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # Email address used for ACME registration
    email: myemailid@gmail.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Name of a secret used to store the ACME account private key
      name: letsencrypt-production-private-key
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
    - http01:
        ingress:
          class: nginx


apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-service
  annotations:
    kubernetes.io/ingress.class: nginx                      
    nginx.ingress.kubernetes.io/rewrite-target: /$1         
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;       
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'        

spec:
  tls:
    - hosts:                                                
        - blog.mydomain.com
      secretName: blog-app-crt-sec                      
      
  rules:                                                    
    - host: blog.mydomain.com                                         
      http:                                                 
        paths:                                              
          - pathType: Prefix
            path: &quot;/?(.*)&quot;                                    
            backend:
              service:
                name: app-1-endpoint
                port: 
                  number: 5000                            
          - pathType: Prefix
            path: &quot;/tribute/?(.*)&quot;
            backend:
              service:
                name: app-2-endpoint
                port: 
                  number: 5001
</code></pre>
<p>When I create above objects, it is creating 2 Certificate ojects, both pointing to same secret.</p>
<ol>
<li>blog-app-crt-sec</li>
<li>blog-app-crt</li>
</ol>
<p>How can I create Only 1 Certificate ? If I create only a ClusterIssuer without any custom certificate, then of course that will solve the issue, but I want to create a Custom certificate to control the renewal stuff.</p>

Sujeet Padhi
<p>There is a component of <code>cert-manager</code> called <code>ingress-shim</code> that watches <code>Ingress</code> resources and automatically creates <code>Certificate</code> objects for you when some annotations are present. This way, you wouldn’t even need to create the Certificate object on your own.</p>
<p>Please check your ingress definition for corresponding <code>cert-manager.io</code> scoped annotations and either use those or the manually created certificate. I assume you refer to the <strong>secret</strong> named <code>blog-app-crt</code> in your ingress definition. This needs to match what is defined in the cert spec <code>secretName</code> if you don’t use the automated creation!</p>
<p>For details on automatic certificate creation, please check the cert-manager docs on ingress: <a href="https://cert-manager.io/docs/usage/ingress/" rel="nofollow noreferrer">https://cert-manager.io/docs/usage/ingress/</a></p>
