{"id":"f28d8298-1bde-46eb-b144-ebae4f3aa4a3","task":"Automate TLS certificate issuance and renewal with cert-manager against an ACME CA, and separately monitor Certificate Transparency logs for unexpected issuance","domain":"cert-manager.io","steps":["Deploy cert-manager in the cluster and create an ACME Issuer or ClusterIssuer that registers an account with the ACME CA; cert-manager generates and stores the account's private key as a Secret.","Define Certificate resources referencing the issuer, DNS names, and a target Secret; cert-manager requests the certificate, completes HTTP-01 or DNS-01 challenges, and writes the issued certificate and key into that Secret automatically.","cert-manager tracks each certificate's expiry and renews it automatically ahead of expiry, rotating the Secret's contents without manual intervention as long as the challenge mechanism keeps working.","Separately from cert-manager, which does not natively monitor Certificate Transparency logs, query a public CT log search service such as crt.sh for your domains on a schedule to detect certificates issued for them outside your own ACME pipeline.","Alert on unexpected CT log entries — an unfamiliar CA, an unexpected subdomain, or an unusual validity period — as a possible mis-issuance or domain-takeover indicator, feeding them into the same incident pipeline as other security alerts."],"gotchas":["Automatic renewal depends on the original challenge mechanism continuing to work at renewal time — a DNS provider credential change or ingress reconfiguration can silently break renewal weeks after the initial issuance succeeded.","CT log monitoring is a detective control, not preventive — it tells you after a certificate was issued, so pair it with CAA DNS records to actually constrain which CAs may issue for your domains.","Public CT search services are third-party and can rate-limit requests or have indexing lag, so don't treat them as a real-time feed."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/f28d8298-1bde-46eb-b144-ebae4f3aa4a3"}