Cert-Manager

cert-manager is a powerful and extensible X.509 certificate controller for Kubernetes and OpenShift workloads. It obtains certificates from a variety of issuers, including Let's Encrypt, HashiCorp Vault, and Venafi, and ensures certificates are valid and up-to-date, attempting to renew them before expiry. It supports certificate issuance for Ingress, Gateway API, and arbitrary workloads via Certificate resources.

Cert-Manager publishes 6 APIs on the APIs.io network. Tagged areas include Certificates, Cloud Native, Graduated, Kubernetes, and Security.

The Cert-Manager catalog on APIs.io includes 1 JSON-LD context and 1 Spectral governance ruleset.

Cert-Manager’s developer surface includes documentation, getting-started guide, changelog, and 9 more developer resources.

🌐 Visit website 📡 Source on GitHub

42.3/100 developing ▬ flat Agent 3/100 human only Full breakdown ↓
scored 2026-07-28 · rubric v0.6

AccessFreemium

6 APIs

CertificatesCloud NativeGraduatedKubernetesSecurityTLS

Kin Score

Kin Score How this is scored →
scored 2026-07-28 · rubric v0.6

Composite quality — 42.3/100 · developing

Contract Quality 7.3 / 25

Developer Ergonomics 6.1 / 20

Commercial Clarity 7.9 / 20

Operational Transparency 6.8 / 13

Governance 7.0 / 12

Discoverability 7.2 / 10

Agent readiness — 3/100 · human only

Machine-Readable Contract 0 / 18

Agentic Access Contract 0 / 10

MCP Server 0 / 12

Machine-Readable Auth 0 / 10

Idempotency 0 / 9

Stable Error Semantics 0 / 8

Request/Response Examples 0 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 0 / 6

Agent Skills 0 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 0 / 8

Dry-Run / Simulate Mode 0 / 4

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/cert-manager: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 6

Individual APIs this provider publishes, each with its own machine-readable definition.

Rate Limits 1

Documented rate limits and quota policies.

Cert Manager Rate Limits

5 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

JSON Schema 2

Standalone JSON Schema definitions for this provider's data models.

Get Started 1

Portal, sign-up, and the first successful call

GettingStarted

GettingStarted

Documentation 4

Reference material describing how the API behaves

Documentation

Reference

JSONSchema

JSONSchema

Design & Contract 1

Pagination, idempotency, versioning, errors, and events

JSONLD

JSONLD

Build 2

SDKs, sample code, and the tooling you integrate with

GitHubOrganization

GitHubOrganization

GitHubRepository

GitHubRepository

Access & Security 1

Authentication, authorization, and security posture

DomainSecurity

DomainSecurity

Operate 2

Status, limits, changes, and where to get help

Community

Community

ChangeLog

ChangeLog

Company 1

The organization behind the API

Website

Website

Source (apis.yml)

aid: cert-manager
name: Cert-Manager
description: cert-manager is a powerful and extensible X.509 certificate controller for Kubernetes and OpenShift workloads.
  It obtains certificates from a variety of issuers, including Let's Encrypt, HashiCorp Vault, and Venafi, and ensures certificates
  are valid and up-to-date, attempting to renew them before expiry. It supports certificate issuance for Ingress, Gateway
  API, and arbitrary workloads via Certificate resources.
url: https://cert-manager.io
accessModel:
  pricing: freemium
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Freemium
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/cert-manager.png
tags:
- Certificates
- Cloud Native
- Graduated
- Kubernetes
- Security
- TLS
created: '2026-03-16'
modified: '2026-04-23'
specificationVersion: '0.19'
type: Index
apis:
- aid: cert-manager:cert-manager-api
  name: cert-manager Kubernetes API
  description: The cert-manager API extends the Kubernetes API with custom resources including Certificate, Issuer, ClusterIssuer,
    CertificateRequest, and Order. These resources allow declarative management of TLS certificates, automatic renewal, and
    integration with ACME and other certificate authorities directly through kubectl and Kubernetes manifests.
  humanURL: https://cert-manager.io/docs/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://cert-manager.io/docs/
  - type: Reference
    url: https://cert-manager.io/docs/reference/api-docs/
  - type: GettingStarted
    url: https://cert-manager.io/docs/getting-started/
  - type: GitHubRepository
    url: https://github.com/cert-manager/cert-manager
  - type: ChangeLog
    url: https://github.com/cert-manager/cert-manager/releases
  - type: JSONSchema
    url: json-schema/cert-manager-certificate-schema.json
  - type: JSONSchema
    url: json-schema/cert-manager-issuer-schema.json
  tags:
  - Certificates
  - Kubernetes API
  - TLS
- aid: cert-manager:cmctl-cli
  name: cert-manager CLI (cmctl)
  description: cmctl is the command-line tool for managing cert-manager resources. It provides commands for checking certificate
    status, manually triggering renewals, approving or denying certificate requests, and converting cert-manager resources
    between API versions.
  humanURL: https://cert-manager.io/docs/reference/cmctl/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://cert-manager.io/docs/reference/cmctl/
  - type: GitHubRepository
    url: https://github.com/cert-manager/cmctl
  - type: ChangeLog
    url: https://github.com/cert-manager/cmctl/releases
  tags:
  - Certificate Management
  - CLI
- aid: cert-manager:trust-manager
  name: trust-manager
  description: trust-manager is a cert-manager companion project for managing TLS trust bundles in Kubernetes and OpenShift
    clusters. It distributes CA bundles via a Bundle custom resource to namespaces and workloads, ensuring that applications
    have access to an up-to-date set of trusted CA certificates without manual maintenance.
  humanURL: https://cert-manager.io/docs/trust/trust-manager/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://cert-manager.io/docs/trust/trust-manager/
  - type: GettingStarted
    url: https://cert-manager.io/docs/trust/trust-manager/installation/
  - type: GitHubRepository
    url: https://github.com/cert-manager/trust-manager
  - type: ChangeLog
    url: https://github.com/cert-manager/trust-manager/releases
  tags:
  - Kubernetes
  - TLS
  - Trust Bundles
- aid: cert-manager:approver-policy
  name: cert-manager approver-policy
  description: approver-policy is a cert-manager policy plugin that automatically approves or denies CertificateRequest resources
    based on defined CertificateRequestPolicy custom resources. It provides fine-grained control over which certificate requests
    are permitted, including constraints on allowed DNS names, key usages, and issuers.
  humanURL: https://cert-manager.io/docs/policy/approval/approver-policy/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://cert-manager.io/docs/policy/approval/approver-policy/
  - type: GitHubRepository
    url: https://github.com/cert-manager/approver-policy
  - type: ChangeLog
    url: https://github.com/cert-manager/approver-policy/releases
  tags:
  - Certificate Approval
  - Policy
  - Security
- aid: cert-manager:csi-driver
  name: cert-manager csi-driver
  description: csi-driver is a Kubernetes Container Storage Interface plugin that works alongside cert-manager to seamlessly
    request and mount certificate key pairs as ephemeral volumes directly into pods. It enables workloads to automatically
    obtain short-lived certificates at pod startup without requiring manual secret management.
  humanURL: https://cert-manager.io/docs/usage/csi-driver/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://cert-manager.io/docs/usage/csi-driver/
  tags:
  - Certificate Management
  - CSI
  - Kubernetes
- aid: cert-manager:csi-driver-spiffe
  name: cert-manager csi-driver-spiffe
  description: csi-driver-spiffe is a Kubernetes CSI plugin that works alongside cert-manager to transparently deliver SPIFFE
    SVIDs as X.509 certificate key pairs to mounted pods using ephemeral volumes. It allows all pods running in a Kubernetes
    cluster to automatically receive SPIFFE identity documents from a configured Trust Domain.
  humanURL: https://cert-manager.io/docs/usage/csi-driver-spiffe/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://cert-manager.io/docs/usage/csi-driver-spiffe/
  - type: GettingStarted
    url: https://cert-manager.io/docs/usage/csi-driver-spiffe/installation/
  tags:
  - CSI
  - Identity
  - Kubernetes
  - SPIFFE
common:
- type: DomainSecurity
  url: security/cert-manager-domain-security.yml
- type: Website
  url: https://cert-manager.io
- type: Documentation
  url: https://cert-manager.io/docs/
- type: GettingStarted
  url: https://cert-manager.io/docs/getting-started/
- type: Reference
  url: https://cert-manager.io/docs/reference/
- type: Community
  url: https://cert-manager.io/docs/contributing/
- type: GitHubOrganization
  url: https://github.com/cert-manager
- type: GitHubRepository
  url: https://github.com/cert-manager/cert-manager
- type: ChangeLog
  url: https://github.com/cert-manager/cert-manager/releases
- type: JSONSchema
  url: json-schema/cert-manager-certificate-schema.json
- type: JSONSchema
  url: json-schema/cert-manager-issuer-schema.json
- type: JSONLD
  url: json-ld/cert-manager-context.jsonld
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Cert-Manager

Kin Score

APIs 6

cert-manager Kubernetes API

cert-manager CLI (cmctl)

trust-manager

cert-manager approver-policy

cert-manager csi-driver

cert-manager csi-driver-spiffe

Pricing Plans 1

Cert Manager Plans Pricing

Rate Limits 1

Cert Manager Rate Limits

FinOps 1

Cert Manager Finops

Semantic Vocabularies 1

Cert Manager Context

Spectral Rules 1

Cert-Manager API Rules

JSON Schema 2

cert-manager Certificate

cert-manager Issuer and ClusterIssuer

Security Posture 1

Cert Manager Domain Security

Resources