<p>I've setup cert-manager in my k8's environment. Using cert-manager v1.6.1 (latest as of writing)</p>
<p>I've setup a ACME Issuer that uses dns01 challenges.</p>
<p>I've created a certificate resource that specifies the spec.duration as 7 hours.</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: mydomain.com
  namespace: my-app
spec:
  secretName: app-certs
  duration: 7h
  renewBefore: 6h
  issuerRef:
    name: acme-issuer
    kind: Issuer
  commonName: mydomain.com
  dnsNames:
    - mydomain.com
</code></pre>
<p>I can see on the certifiatesigningrequest resource that it interprets the duration that I've set on the certificate.</p>
<pre><code>Spec:
  Duration:  7h0m0s
</code></pre>
<p>Everything seems to come back good on the certificate signing request. No errors or anything and I see the certificate is generated sucessfully.</p>
<pre><code>Conditions:
  Last Transition Time:  2021-12-14T20:10:15Z
  Message:               Certificate request has been approved by cert-manager.io
  Reason:                cert-manager.io
  Status:                True
  Type:                  Approved
  Last Transition Time:  2021-12-14T20:10:16Z
  Message:               Certificate fetched from issuer successfully
  Reason:                Issued
  Status:                True
  Type:                  Ready
</code></pre>
<p>yet the certificate actually is using the default duration (see renewal time)</p>
<pre><code>Status:
  Conditions:
    Last Transition Time:  2021-12-14T20:10:16Z
    Message:               Certificate is up to date and has not expired
    Observed Generation:   4
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2022-03-14T19:10:14Z
  Not Before:              2021-12-14T19:10:15Z
  Renewal Time:            2022-03-14T18:30:14Z
</code></pre>
<p>So is there something I'm doing wrong? I think if the acme challenge failed it wouldn't issue any certificate. How can I set the duration properly?</p>

alex
<p>Apparently Let's Encrypt only allows for 90 day valid certificates (<a href="https://letsencrypt.org/2015/11/09/why-90-days.html" rel="nofollow noreferrer">source</a>).</p>
<blockquote>
<p>We’re sometimes asked why we only offer certificates with ninety-day lifetimes. People who ask this are usually concerned that ninety days is too short and wish we would offer certificates lasting a year or more, like some other CAs do.</p>
</blockquote>
<p>And later on in the article</p>
<blockquote>
<p>Once automated renewal tools are widely deployed and working well, we may consider even shorter lifetimes.</p>
</blockquote>
<p>What I ended up doing was specifying the certificate <code>renewBefore</code> to when I wanted it to renew.</p>
<p>Other options: You can also look at Step CA certificates which have lower age validity times than Let's Encrypt does.</p>
