<p>I am working with cert-manager and kong-ingress-controller to enable https in kubernetes.</p>

<p>I am interested in figure out how is the renewal process, when I just using a <code>ClusterIssuer</code> and the certificate that it generate by default when we use the ingress resource. </p>

<p>I am not using the <code>kind: Certificate</code> resource, this means that I am not defining a X.509 custom certificate to be signed and obtain the certificate validated through the reference to my <code>ClusterIssuer</code>.</p>

<p>At the moment I've created a <code>ClusterIssuer</code> and one ingress resource, whose automatically creates one certificate named <code>letsencrypt-prod</code> which will be used for perform the <code>http01</code> validation between <code>cert-manager</code> and letsencrypt CA</p>

<p>Finally, I have this output:</p>

<pre><code>I0321 10:49:48.505664       1 controller.go:162] certificates controller: syncing item 'default/letsencrypt-prod'
I0321 10:49:48.506008       1 conditions.go:143] Found status change for Certificate "letsencrypt-prod" condition "Ready": "False" -&gt; "True"; setting lastTransitionTime to 2019-03-21 10:49:48.506003434 +0000 UTC m=+168443.026129945
I0321 10:49:48.506571       1 sync.go:263] Certificate default/letsencrypt-prod scheduled for renewal in 1438h59m58.49343646s
I0321 13:57:46.226424       1 controller.go:168] certificates controller: Finished processing work item "default/letsencrypt-prod"
I0321 15:12:53.199067       1 controller.go:178] ingress-shim controller: syncing item 'default/kong-ingress-service'
I0321 15:12:53.199171       1 sync.go:183] Certificate "letsencrypt-prod" for ingress "kong-ingress-service" is up to date
</code></pre>

<p>This means that my certificate will be renoved within <strong>1438h-59m-58.49343646s</strong>. This means 3 months aproximately</p>

<p>This means, will be automatically renoved really? </p>

<p>such as indicated <a href="https://cert-manager.readthedocs.io/en/latest/reference/certificates.html#certificate-duration-and-renewal-window" rel="nofollow noreferrer">here</a>:  </p>

<blockquote>
  <p>The default duration for all certificates is 90 days and the default renewal windows is 30 days. This means that certificates are considered valid for 3 months and renewal will be attempted within 1 month of expiration.</p>
</blockquote>

<p>The cert manager documentation say :</p>

<blockquote>
  <p>Although the duration and renewal periods are specified on the Certificate resources, the corresponding Issuer or ClusterIssuer must support this.</p>
</blockquote>

<p>My Cluster Issuer is:</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer 
metadata:
  name: letsencrypt-prod
spec:
 acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: my-email@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    http01: {}
</code></pre>

<p>How to can I manage the <code>duration</code> and <code>renewBefore</code> parameters if I am not creating a Certificate Resource. ?</p>

<p>According to this can I add the <code>duration</code> and <code>renewBefore</code> parameters in my ClusterIssuer? Maybe of this way?</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer 
metadata:
  name: letsencrypt-prod
spec:
 acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: my-email@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    http01: {}
 # ...
 duration: 24h
 renewBefore: 12h 
</code></pre>

bgarcial
<p>This is not supported on the issuers\clusterissuers, only on certificates. you can create a <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">admission controllers</a> to mutate certificates or you can have a cronjob to update certificate resources after they are created</p>
