{
  "id": 15219997,
  "title": "When a cert-manager Keystore Runs Behind a Password Change",
  "url": "https://urgent.news/2026/10/17/when-a-cert-manager-keystore-runs-behind-a-password-change",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-17T15:10:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/whenitruns/when-a-cert-manager-keystore-runs-behind-a-password-change-3i35"
  },
  "original_language": "en",
  "account": "When using cert-manager v1.21.2, if the keystore password is changed, the keystore entries in the target Secret remain encrypted with the old password for a 30-minute window. This was observed in a single-node kind cluster environment and occurred regardless of whether the password change was made through a referenced Secret or an inline password field. The Certificate itself remained in a Ready=True state, but the keystore entries stayed encrypted until the certificate was re-issued. The API reference states that the keystore file should be updated immediately after the password change, which contradicts the observed behavior.",
  "summary": "cert-manager v1.21.2's API reference: \"The keystore file will be updated immediately.\" After a password change, the keystores opened only with the old password throughout our 30-minute window. When It Runs — Run Report #RR08 · Testing what infrastructure actually does. Provider · Component: cert-manager · the keystore outputs of a Certificate ( spec.keystores.jks / spec.keystores.pkcs12 with…",
  "key_points": [
    "Cert-manager v1.21.2 has keystore password change issue",
    "Keystore entries remain encrypted for 30 minutes post-change",
    "Certificate stays Ready=True, but entries stay encrypted"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}