Expert cert-manager quiz
A free expert cert-manager quiz with up to 40 multiple-choice questions on Certificates, Issuers, ACME challenges, renewal and trust distribution. Written for engineers who run it in production, with an explanation for every answer.
Loading Quiz...
Preparing your cert-manager Expert level questions
Browse the 20 hard cert-manager questions, with answers
- Which of the following is a valid way to revoke a certificate in cert-manager?
- Which of the following is a valid way to configure a Vault issuer?
- What is the purpose of the 'keystores' field in a Certificate resource?
- What is the purpose of the 'encodeUsagesInRequest' field in a Certificate resource?
- Which of the following is a valid way to debug a failing HTTP-01 challenge?
- Which of the following is a valid way to configure a DNS-01 challenge for a Route53 provider?
- Which of the following is NOT a valid way to secure cert-manager's webhook?
- When you create a Certificate that uses an ACME issuer, which chain of resources does cert-manager create?
- A ClusterIssuer for DNS-01 references a Secret holding DNS provider credentials. In which namespace does cert-manager look for that Secret?
- How do you get cert-manager to create and manage a Certificate for an Ingress automatically?
- What does privateKey.rotationPolicy: Always do on a Certificate?
- How do you make cert-manager reissue a certificate right away, before it is due for renewal?
- What does the Secret named in an ACME issuer's privateKeySecretRef contain?
- Let's Encrypt fails HTTP-01 validation for app.example.com. Which URL must be reachable from the internet?
- A Certificate fails to issue several times in a row, for example because the issuer is misconfigured. How does cert-manager retry?
- Which cert-manager sub-project copies CA bundles into namespaces as ConfigMaps or Secrets, so applications can trust a private CA?
- Which cert-manager component issues a certificate straight into a pod's volume without creating a Secret?
- What has to happen to a CertificateRequest before an issuer will sign it?
- Which annotation tells cainjector to fill a webhook configuration's caBundle from a cert-manager Certificate?
- cert-manager can't be given API access to the DNS zone for example.com. How can you still use DNS-01 for it?