Free tools Windows power users keep installed
One-click scans. No signup required.
To avoid unnecessary certificate issuance after rebuilding a Kubernetes cluster, restore the certificate’s TLS Secret before its Certificate resource—and before an Ingress when ingress-shim manages certificates. Exclude transient ACME Order and Challenge resources from backups so cert-manager can reconstruct work from durable configuration rather than potentially incomplete saved status.
Why restore order can trigger issuance
cert-manager stores a certificate and its private key in a Kubernetes Secret. That Secret is part of the state needed to restore a working certificate, not merely an output that can safely be recreated later.
As an Amazon Associate I earn from qualifying purchases.
If a restored Certificate becomes visible before its Secret, cert-manager can see the certificate as missing and initiate issuance. The same timing concern applies to an Ingress when ingress-shim is responsible for creating a Certificate. This is a documented operational race, not evidence of a specific version-specific defect called “the Restore Race.” The cert-manager v1.19 restore guide states: “If cert-manager does not find a Kubernetes Secret with an X.509 certificate for a Certificate, reissuance will be triggered.” cert-manager v1.19 backup and restore guidance
Restore durable state in a deliberate order
The cert-manager v1.19 backup guidance describes a conceptual sequence. Exact mechanics depend on your backup tool and the resource types it restores.
#1 Best Overall
- Install cert-manager and its CRDs. The custom resource definitions must exist before restoring cert-manager resources.
- Restore referenced issuer credentials and certificate Secrets. Ensure the TLS Secrets exist before their associated
Certificateresources become visible. - Restore durable desired state. Restore
Certificateresources, or dependentIngressresources if ingress-shim is in use, after the Secrets they rely on. - Let cert-manager reconcile transient ACME work. Avoid replaying stale operational resources whose saved status may not describe what the ACME server has completed.
The v1.19 guide notes that Velero’s default ordering restores Secrets before Ingresses and custom resources later. That is tool- and version-specific guidance, not a universal guarantee: backup tools may not restore custom-resource status or owner references as expected. Check the behavior of the tool and configuration used for your recovery.
Leave transient ACME work out of the restore
The ACME lifecycle runs from Certificate to CertificateRequest, then to Order and Challenge. Orders and Challenges represent work in progress, not durable certificate intent. Backup tools may omit custom-resource status, and restored status can be incomplete or absent even when the ACME server has already handled part of the process. Replaying that snapshot can leave Kubernetes state out of sync with the CA’s state.
Rank #2
cert-manager recommends excluding Orders and Challenges from backups; its restore guidance also warns that CertificateRequests and other transient ACME state can have incomplete status or depend on ephemeral resources. Restore the durable configuration and let cert-manager reconstruct the necessary work instead. cert-manager v1.19 backup and restore guidance and cert-manager FAQ
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesChallenge concurrency is not a CA rate-limit budget
cert-manager’s challenge scheduler provides back-pressure within the cluster: by default it allows 60 concurrent Challenges and prevents concurrent challenges for the same HTTP-01 hostname or DNS-01 _acme-challenge name. But that scheduling does not predict how a certificate authority will apply its own limits. As the project documentation puts it, “The scheduler does not attempt to model CA-specific rate limits, tenant fairness, or ownership policy for DNS names.” cert-manager ACME Orders and Challenges
Let’s Encrypt maintains separate rate-limit rules. Its current policy page says renewals recognized through ACME Renewal Info (ARI) are exempt from all rate limits, while renewals recognized through an older exact-identifier method may remain subject to some limits. A post-restore request should not automatically be assumed to qualify as a recognized renewal. Check the current policy rather than relying on a remembered numeric quota. Let’s Encrypt rate limits
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose a pending Challenge before intervening
A Challenge can remain pending because cert-manager’s propagation self-check cannot see the proof, regardless of what the CA has or has not accepted. Check the Challenge’s status and events, especially its Reason, Presented, and Processing fields. The self-check retries every 10 seconds when propagation has not passed; this is cert-manager’s retry interval, not the CA’s, and it does not prove that the CA accepted or rejected an Order. cert-manager ACME Orders and Challenges
- For HTTP-01: Check that the challenge URL is reachable from the public internet and from the cluster’s own vantage point.
- For DNS-01: Check that the
_acme-challengeTXT record is visible publicly and that the resolver used by cert-manager’s self-check can see it.
Only after identifying the failure should you intervene. The cert-manager documentation describes deleting an Order or correcting the Certificate when a self-check never succeeds. Repeatedly deleting and recreating resources as a first response can create fresh Orders and increase issuance attempts. cert-manager ACME troubleshooting
Recommended Free Tools
Quick Recap
What to verify in a recovery plan
- Certificate Secrets are restored before the corresponding
Certificateor ingress-shim-managedIngress. - Backups exclude ephemeral
OrdersandChallenges, and account for the limitations of restoringCertificateRequests. - The backup tool’s handling of custom-resource status and owner references is understood for the specific recovery configuration.
- Potential ACME requests are assessed against the CA’s current policy rather than cert-manager’s concurrency settings.
- HTTP-01 or DNS-01 propagation is checked from the relevant public and cluster resolver vantage points.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
