Configure a cert-manager DNS01 webhook solver for a DNS provider without built-in support

domain: cert-manager.io · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Confirm no in-tree provider fits (ACMEDNS, Akamai, AzureDNS, Cloudflare, DigitalOcean, Google CloudDNS, RFC2136, Route53) and check for an existing community solver on the cert-manager-webhook GitHub topic before writing your own.
  2. Scaffold a solver implementing the webhook.Solver interface (Name, Present, CleanUp, Initialize), using the cert-manager/webhook-example repository as the template, and deploy it as its own Deployment/Service registered as a Kubernetes APIService.
  3. Run the DNS01 provider conformance test suite included in the webhook-example repo against your implementation before wiring it into any Issuer - this is required by cert-manager's own DNS provider guidelines.
  4. In the Issuer or ClusterIssuer, add a solvers[].dns01.webhook block with groupName (a unique API group you control, e.g. acme.mycompany.com), solverName (must exactly match what your Solver.Name() returns), and a config block holding provider-specific settings.
  5. Verify groupName and solverName in the Issuer match the values registered by the webhook's APIService/Helm chart exactly, since cert-manager routes ACME Present/CleanUp calls to your webhook purely based on this group name match.

Known gotchas

Related routes

Configure a Kubernetes admission webhook with cert-manager for TLS provisioning and implement a ValidatingWebhookConfiguration to enforce custom policies
kubernetes.io · 5 steps · unrated
Configure a cert-manager ClusterIssuer with ACME DNS01 challenge using Route53 and create a wildcard certificate
cert-manager.io · 6 steps · unrated
Configure cert-manager DNS01 challenges with Route53 to issue a wildcard certificate
cert-manager.io · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans