# cert-manager changelog

> Automated X.509 certificate issuance and renewal for Kubernetes.

- Vendor: CNCF
- Category: Developer Tools
- Official site: https://cert-manager.io
- Tracked by: What's New (https://whatsnew.fyi/product/cert-manager)
- Harvested from: GitHub (cert-manager/cert-manager)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.21.1

- Date: 2026-07-29
- Version: v1.21.1
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.1

- **fixed** — Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled
- **fixed** — Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created
- **fixed** — Fix log spam and dropped Secret informer events for non-cert-manager Secrets caused by a generics regression introduced in 1.21.0
- **fixed** — Fix the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable
- **security** — Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability
- **security** — Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability
- **security** — Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability
- **security** — Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability
- **changed** — Update distroless base images

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

##### Changes by Kind

###### Bug or Regression

- Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
- Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
- Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
- Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. (#9012, @mateenali66)

###### Other (Cleanup or Flake)

- Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
- Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability (#9063)
- Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability (#9072)
- Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability (#9073)
- Update distroless base images (#9000, #9025)

### v1.21.0

- Date: 2026-07-08
- Version: v1.21.0
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0

- **added** — ACME Renewal Information (ARI) experimental support for RFC 9773 behind the ACMEUseARI feature gate to query the ACME server's renewalInfo endpoint for the recommended renewal window
- **added** — waitInsteadOfSelfCheck solver option to skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate
- **added** — AWS IAM authentication for Vault issuer supporting IRSA, EKS Pod Identity, and ambient EC2/ECS credentials
- **removed** — Default tokenrequest RBAC Role and RoleBinding from Helm chart that granted cert-manager controller permission to create tokens for its own ServiceAccount
- **changed** — cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io
- **removed** — Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path
- **changed** — Controller Service metrics port renamed from tcp-prometheus-servicemonitor to http-metrics

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.

##### Known Issues

- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature (#8258) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See #9031 for details.
- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring (#8407) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See #8994 for details.
- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets (#8255) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See cert-manager/cert-manager#9036 for details and a fix proposal.

##### Major Themes

###### Default `tokenrequest` RBAC removed from Helm chart

> ⚠️ Breaking change

The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.

If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).

###### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole

> ⚠️ Potentially breaking change

The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because

_[Truncated at 4000 characters — full notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0]_

### v1.21.0-beta.0

- Date: 2026-07-01
- Version: v1.21.0-beta.0
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-beta.0
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0-beta.0
- Labels: Pre-release

- **added** — Add certificateRequestMaximumBackoffDuration controller configuration option to cap retry backoff time for failed CertificateRequests, configurable via config file, CLI flag, or Helm value, with a default of 32 hours
- **added** — Add an optional waitInsteadOfSelfCheck field to ACME HTTP01 and DNS01 solvers to skip cert-manager's self-check and ask the ACME server to validate after a configured wait
- **added** — Add configurable runtimeClassName support for cert-manager components and ACME HTTP01 solver pods
- **added** — Add ARI support through the ACMEUseARI feature gate
- **added** — Add AWS IAM authentication support for Vault issuer, including IRSA and ambient credentials
- **added** — Add support for the Modern2026 go-pkcs12 profile and FIPS 140-3
- **added** — Add a new flag --ignore-namespaces to the cainjector binary to filter out namespaces from being watched for secrets
- **added** — Process annotations cert-manager.io/alt-names and cert-manager.io/ip-sans to Certificates generated from ingress like objects in cert-shim controllers
- **added** — Add support for the acme.cert-manager.io/http01-parentreffallback annotation to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet
- **changed** — Disable client side rate-limiting if AP&F is enabled
- **fixed** — ACME challenges no longer terminally fail on transient network errors during nonce fetches and authorization waits
- **fixed** — Fix webhook serving certificate not being renewed after system suspend
- **fixed** — Fix a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress
- **fixed** — Fix an integer overflow in renewBeforePercentage calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected or assigned incorrect renewal times
- **fixed** — Fix potential OOM in DNS-over-HTTPS client by bounding response body read with a 128 KB cap
- **fixed** — Fix validation of timezone-prefixed renewal window cron specs without a schedule
- **fixed** — Harden ACME Challenge and Order resources by rejecting user-created Challenges without Order ownership, enforcing Order spec immutability, and detecting pre-placed same-name Challenges with mismatched specs
- **fixed** — Remove ACME Challenge create and Order create/patch/update from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources
- **fixed** — Update logic to identify and preserve the secret matching nextPrivateKeySecretName
- **fixed** — Vault Issuer webhook validation now rejects ... path segments in spec.vault.path and auth mount path fields to prevent path.Join from silently resolving relative segments
- **removed** — Remove Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path; users must remove these keys from their value overrides before upgrading

> [!NOTE]
> ⚠️ This is a pre-release. For testing only!

For full release notes including breaking changes, upgrade notes, major themes and community credits, see the [v1.21 release notes](https://release-next--cert-manager.netlify.app/docs/releases/release-notes/release-notes-1.21/).

##### Changes since v1.21.0-alpha.1

###### Feature

- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. (#8893, @lunarwhite)
- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. (#8858, @wallrj)
- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. (#8791, @jsoref)
- Added ARI support through the ACMEUseARI feature gate. (#8798, @hjoshi123)
- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). (#8422, @bitloi)
- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3. (#8841, @seanorama)
- A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. (#8614, @figaw)
- Disabled client side rate-limiting if AP&F is enabled. (#8757, @hjoshi123)
- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. (#8927, @jabbrwcky)
- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. (#8749, @apkatsikas)

###### Bug or Regression

- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). (#8931, @wallrj-cyberark)
- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. (#8760, @texasich)
- Fix webhook serving certificate not being renewed after system suspend. (#8464, @Peac36)
- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). (#8962, @hjoshi123)
- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. (#8947, @ThatsMrTalbot)
- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). (#8803, @SebTardif)
- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. (#8813, @immanuwell)
- Harden ACME Challenge and Order resources: re

_[Truncated at 4000 characters — full notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-beta.0]_

### v1.19.6

- Date: 2026-06-25
- Version: v1.19.6
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.6
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.19.6

- **security** — Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole to prevent users from bypassing Issuer solver selectors and disclosing DNS credentials
- **changed** — Update Go to v1.25.11 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also includes Go version bumps to address reported CVEs. All users should upgrade.

> [!WARNING]
> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

##### Changes by Kind

###### Bug or Regression

- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#8941](https://github.com/cert-manager/cert-manager/pull/8941), [@wallrj-cyberark](https://github.com/wallrj-cyberark))

###### Other (Cleanup or Flake)

- Update Go to `v1.25.11` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8925](https://github.com/cert-manager/cert-manager/pull/8925), [@wallrj-cyberark](https://github.com/wallrj-cyberark))
- Upgrade Go to 1.25.10 to fix reported vulnerabilities, along with other dependency bumps ([#8788](https://github.com/cert-manager/cert-manager/pull/8788), [@SgtCoDFish](https://github.com/SgtCoDFish))

### v1.20.3

- Date: 2026-06-25
- Version: v1.20.3
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.20.3

- **security** — Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole to prevent users from bypassing Issuer solver selectors and disclosing DNS credentials
- **fixed** — Remove issuer owner reference from challenges blocking challenge garbage collection
- **changed** — Update Go to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.

All users should upgrade.

> [!WARNING]
> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

##### Changes by Kind

###### Bug or Regression

- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). (#8940, @wallrj-cyberark)
- Remove issuer owner reference from challenges blocking challenge garbage collection (#8759, @cert-manager-bot)

###### Other (Cleanup or Flake)

- Bump go to 1.26.3, other deps to fix several govulncheck issues (#8789, @SgtCoDFish)
- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#8926, @wallrj-cyberark)

### v1.21.0-alpha.1

- Date: 2026-06-08
- Version: v1.21.0-alpha.1
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-alpha.1
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0-alpha.1
- Labels: Pre-release

- **added** — Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors
- **added** — Add new controller flag --acme-http01-solver-extra-labels allowing Helm's global.commonLabels to propagate to all dynamically-created ACME HTTP01 solver resources
- **added** — Add opt-in startupapicheck.ttlSecondsAfterFinished Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller
- **added** — Add cert-manager.io/ignore-tls-listeners annotation for ignoring gwapi listeners
- **added** — Add option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates
- **added** — Extend the Venafi/CyberArk integration to also support PANW NGTS
- **changed** — Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate
- **fixed** — Add dns issuer secrets validation before marking it as ready
- **fixed** — Add missing issuer finalizer RBAC to the order controller to support owner references
- **fixed** — ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace
- **fixed** — Fix Venafi TPP issuer setup and signing regression: restore authentication of the vcert connector in the client constructor
- **fixed** — Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries; negative results are now cached for 30 seconds
- **fixed** — Fix infinite re-issuance loop when issuer returns an already expired certificate
- **fixed** — Fix local e2e-setup-samplewebhook installation to use the samplewebhook image repository and tag from the saved image tarball manifest
- **fixed** — Fix Helm chart to rename image helper to avoid umbrella chart conflicts
- **fixed** — Fix invalid YAML generated when both webhook.config and webhook.volumes are defined
- **fixed** — Remove issuer owner reference from challenges blocking challenge garbage collection
- **deprecated** — The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet

##### Changes since v1.21.0-alpha.0

> [!NOTE]
> ⚠️ This is a pre-release. For testing only!

###### Feature

- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps)
- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#8761, @lunarwhite)
- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#8523, @dap0am)
- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. (#8727, @hjoshi123)
- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. (#8683, @ThatsMrTalbot)
- Extend the Venafi/CyberArk integration to also support PANW NGTS. (#8779, @FelixPhipps)
- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate (#8692, @erikgb)

###### Bug or Regression

- Add dns issuer secrets validation before marking it as ready (#8255, @Peac36)
- Add missing issuer finalizer RBAC to the order controller to support owner references (#8654, @erikgb)
- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. (#8822, @lunarwhite)
- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. (#8843, @wallrj-cyberark)
- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. (#8651, @mateenali66)
- Fixed infinite re-issuance loop when issuer returns an already expired certificate (#8610, @onurmicoogullari)
- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#8821, @wallrj)
- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts (#8753, @FelixPhipps)
- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. (#8664, @jnohlgard)
- Remove issuer owner reference from challenges blocking challenge garbage collection (#8743, @erikgb)

###### Other (Cleanup or Flake)

- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. (#8732, @ThatsMrTalbot)

### v1.19.5

- Date: 2026-04-21
- Version: v1.19.5
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.5
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.19.5

- **security** — Bump go dependencies with reported vulnerabilities
- **security** — Bump go to 1.25.8 to address several reported vulnerabilities
- **changed** — Bump go to 1.25.9

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.

##### Changes by Kind

###### Other (Cleanup or Flake)

- Bump go dependencies with reported vulnerabilities ([#8706](https://github.com/cert-manager/cert-manager/pull/8706), [@erikgb](https://github.com/erikgb))
- Bump go to 1.25.8 to address several reported vulnerabilities ([#8628](https://github.com/cert-manager/cert-manager/pull/8628), [@SgtCoDFish](https://github.com/SgtCoDFish))
- Bump go to 1.25.9 ([#8705](https://github.com/cert-manager/cert-manager/pull/8705), [@erikgb](https://github.com/erikgb))

### v1.20.2

- Date: 2026-04-11
- Version: v1.20.2
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.20.2
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.20.2

- **fixed** — Fix invalid YAML generated in Helm chart when both webhook.config and webhook.volumes are defined
- **security** — Bump Go to 1.26.2 and dependencies to address reported vulnerabilities

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config`
and `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies
to address reported vulnerabilities.

##### Changes by Kind

###### Bug or Regression

- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. (#8665, @cert-manager-bot)

###### Other (Cleanup or Flake)

- Bump go dependencies with reported vulnerabilities (#8704, @erikgb)
- Bump go to 1.26.2 (#8703, @erikgb)

### v1.20.1

- Date: 2026-03-27
- Version: v1.20.1
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.20.1
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.20.1

- **fixed** — Fixed duplicate parentRef bug when both issuer config and annotations are present in Gateway API
- **fixed** — Add missing issuer finalizer RBAC to the order controller to support owner references, fixing OpenShift upgrade issues
- **changed** — Bump google.golang.org/grpc to address a reported vulnerability

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).

###### Bug or Regression

- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. (#8658, @hjoshi123)
- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. (#8655, @erikgb)
- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. (#8657, @erikgb)

### v1.21.0-alpha.0

- Date: 2026-03-24
- Version: v1.21.0-alpha.0
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-alpha.0
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0-alpha.0
- Labels: Pre-release

- **added** — Add certificate renewal policies
- **changed** — Promote CAInjectorMerging feature gate to GA
- **fixed** — Fix duplicate parentRef bug when both issuer config and annotations are present
- **removed** — Remove deprecated ObjectReference

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

> ⚠️ This is a pre-release. For testing only!

##### Changes by Kind since `v1.20.0`

###### Feature

- Feat(certificate): adding certificate renewal policies (#8258, @hjoshi123)
- Promote the CAInjectorMerging feature gate to GA (#8583, @Copilot)

###### Bug or Regression

- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. (#8619, @hjoshi123)

###### Other (Cleanup or Flake)

- API cleanup: removed deprecated ObjectReference (#8625, @inteon)