{
  "id": 16250359,
  "title": "When cert-manager's Ready Condition Runs Past Expiry Until a Reconcile",
  "url": "https://urgent.news/2026/10/24/when-cert-managers-ready-condition-runs-past-expiry-until-a-reconcile",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T00:21:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/whenitruns/when-cert-managers-ready-condition-runs-past-expiry-until-a-reconcile-4442"
  },
  "original_language": "en",
  "account": "On September 28, 2026, during testing of cert-manager v1.21.2, a renewal-blocked Certificate remained in the \"Ready=True\" state, despite its expiration, for the entire 30-minute observation window. The Certificate, with a 1-hour duration and renewBefore set to 55 minutes, was issued by a SelfSigned Issuer and then the Issuer was deleted to block renewal, generating no additional events. Despite the certificate expiring, the Ready condition remained unchanged until a controller restart occurred, approximately 34 minutes after expiration. The condition message \"Certificate is up to date and has not expired\" persisted, misleadingly indicating the certificate's validity. This behavior was observed in a single-node kind cluster running cert-manager v1.21.2, using a 1-hour duration, renewalBefore setting of 55 minutes, and a 30-second polling interval for 30 minutes past the certificate's expiration. The issue, reported as #7895, highlights the discrepancy between the Ready condition and the actual certificate state when renewal is blocked. This behavior was measured in a controlled environment, with the findings published at https://whenitruns.substack.com/p/when-cert-managers-ready-condition and the reproduction repository available at https://github.com/whenitruns/when-cert-managers-ready-condition-runs-past-expiry-until-a-reconcile.",
  "summary": "On cert-manager v1.21.2, a renewal-blocked Certificate kept Ready=True (\"Certificate is up to date and has not expired\") past notAfter through our 30-minute window, until a restart reconciled it. When It Runs — Run Report #RR10 · Testing what infrastructure actually does. Provider · Component: cert-manager · the Certificate Ready condition (readiness controller) after status.notAfter has passed,…",
  "key_points": [
    "Cert-manager v1.21.2 failed to update Ready condition after certificate expiration",
    "Certificate remained Ready=True for 30 minutes despite 1-hour expiry",
    "Issue resolved by restarting controller, not by certificate renewal"
  ],
  "editors_take": "The persistence of a false Ready status when renewal is blocked creates a dangerous gap between reported certificate validity and actual expiration, potentially misleading operators during critical security windows.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}