Certificate Management & mTLS Basics (cert-manager Operator)
Duration: ~20 minutes
Overview
Learn how to deploy and configure cert-manager Operator for automated certificate provisioning, renewal, and management. You’ll implement mutual TLS (mTLS) between services to ensure authenticated and encrypted communication.
Install cert-manager, issue certificates automatically, and enable basic service-to-service mTLS with verifiable rotation.
Why it matters
Manual certificate management is error-prone and leads to expired certificates causing outages. Cert-manager automates the entire certificate lifecycle—provisioning, renewal, and revocation—reducing operational overhead and security risks. Mutual TLS adds an extra layer of security by requiring both client and server authentication.
What does it solve
-
Certificate expiration outages
-
Manual certificate management overhead
-
Unencrypted service communication
-
Man-in-the-middle attacks
-
Certificate provisioning complexity
Your Mission
Complete the examples below to close the attack paths this lab covers—treat each step as defending the cluster, not just clicking through commands.
Click each step only if you need a hint.
Check cert-manager installation
oc get pods -n openshift-cert-manager
oc get crd certificates.cert-manager.ioCreate ClusterIssuer
oc apply -f - <<'EOF'
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned-issuer
spec:
selfSigned: {}
EOFCreate Certificate resource
oc apply -f - <<'EOF'
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: example-cert
namespace: 201-09-demo
spec:
secretName: example-cert-tls
issuerRef:
name: selfsigned-issuer
kind: ClusterIssuer
dnsNames:
- example.201-09-demo.svc.cluster.local
EOFVerify certificate creation
oc get certificate -n 201-09-demo
oc get secret example-cert-tls -n 201-09-demoCleanup
oc delete project 201-09-demo --wait=falseDebrief
cert-manager automates issuance and renewal so expiry outages disappear; mTLS adds service-to-service identity beyond perimeter TLS.
What breaks without this:
-
Manual certs → outages at expiry and rushed key handling
-
Cleartext or one-way TLS only → lateral sniffing and spoofing between services
Controls that matter: ClusterIssuer/Certificate CRs, auto-renew before expiry, mTLS where trust boundaries need mutual proof, and protected key material.
Quick facts: use public CA, private CA, or self-signed to match your trust model; renewal timing is the reliability win.
