# cert-manager v1.21.0-beta.0

- Product: cert-manager (https://whatsnew.fyi/product/cert-manager)
- Vendor: CNCF
- Date: 2026-07-01
- Version: v1.21.0-beta.0
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-beta.0
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0-beta.0
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add certificateRequestMaximumBackoffDuration controller configuration option to cap retry backoff time for failed CertificateRequests, configurable via config file, CLI flag, or Helm value, with a default of 32 hours
- **added** — Add an optional waitInsteadOfSelfCheck field to ACME HTTP01 and DNS01 solvers to skip cert-manager's self-check and ask the ACME server to validate after a configured wait
- **added** — Add configurable runtimeClassName support for cert-manager components and ACME HTTP01 solver pods
- **added** — Add ARI support through the ACMEUseARI feature gate
- **added** — Add AWS IAM authentication support for Vault issuer, including IRSA and ambient credentials
- **added** — Add support for the Modern2026 go-pkcs12 profile and FIPS 140-3
- **added** — Add a new flag --ignore-namespaces to the cainjector binary to filter out namespaces from being watched for secrets
- **added** — Process annotations cert-manager.io/alt-names and cert-manager.io/ip-sans to Certificates generated from ingress like objects in cert-shim controllers
- **added** — Add support for the acme.cert-manager.io/http01-parentreffallback annotation to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet
- **changed** — Disable client side rate-limiting if AP&F is enabled
- **fixed** — ACME challenges no longer terminally fail on transient network errors during nonce fetches and authorization waits
- **fixed** — Fix webhook serving certificate not being renewed after system suspend
- **fixed** — Fix a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress
- **fixed** — Fix an integer overflow in renewBeforePercentage calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected or assigned incorrect renewal times
- **fixed** — Fix potential OOM in DNS-over-HTTPS client by bounding response body read with a 128 KB cap
- **fixed** — Fix validation of timezone-prefixed renewal window cron specs without a schedule
- **fixed** — Harden ACME Challenge and Order resources by rejecting user-created Challenges without Order ownership, enforcing Order spec immutability, and detecting pre-placed same-name Challenges with mismatched specs
- **fixed** — Remove ACME Challenge create and Order create/patch/update from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources
- **fixed** — Update logic to identify and preserve the secret matching nextPrivateKeySecretName
- **fixed** — Vault Issuer webhook validation now rejects ... path segments in spec.vault.path and auth mount path fields to prevent path.Join from silently resolving relative segments
- **removed** — Remove Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path; users must remove these keys from their value overrides before upgrading

> [!NOTE]
> ⚠️ This is a pre-release. For testing only!

For full release notes including breaking changes, upgrade notes, major themes and community credits, see the [v1.21 release notes](https://release-next--cert-manager.netlify.app/docs/releases/release-notes/release-notes-1.21/).

##### Changes since v1.21.0-alpha.1

###### Feature

- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. (#8893, @lunarwhite)
- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. (#8858, @wallrj)
- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. (#8791, @jsoref)
- Added ARI support through the ACMEUseARI feature gate. (#8798, @hjoshi123)
- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). (#8422, @bitloi)
- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3. (#8841, @seanorama)
- A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. (#8614, @figaw)
- Disabled client side rate-limiting if AP&F is enabled. (#8757, @hjoshi123)
- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. (#8927, @jabbrwcky)
- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. (#8749, @apkatsikas)

###### Bug or Regression

- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). (#8931, @wallrj-cyberark)
- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. (#8760, @texasich)
- Fix webhook serving certificate not being renewed after system suspend. (#8464, @Peac36)
- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). (#8962, @hjoshi123)
- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. (#8947, @ThatsMrTalbot)
- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). (#8803, @SebTardif)
- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. (#8813, @immanuwell)
- Harden ACME Challenge and Order resources: re

_[Truncated at 4000 characters — full notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-beta.0]_