# Since cert-manager v1.21.3, when will the issuing controller use the Secret named in a Certificate's status.nextPrivateKeySecretName?

cert-manager, Hard (Expert), Security. https://k8wiz.com/uquiz/since-cert-manager-v1213-when-will-the-issuing-controller-use-the-secret-named-in-a-certificates-statusnextprivatekeysecretname

- A. Only when it is in the cert-manager namespace and of type kubernetes.io/tls
- B. Only when it has the next-private-key label and the Certificate owns it
- C. Only when its name is spec.secretName with a -next suffix added to it
- D. Only when it was created after the Certificate's latest CertificateRequest

**Answer:** Only when it has the next-private-key label and the Certificate owns it

**Explanation:** The requestmanager and issuing controllers now only consume that Secret if it carries the cert-manager.io/next-private-key label and is owned by the Certificate. This stops the controller from copying a private key out of a Secret the Certificate doesn't own. The keymanager always uses a generated name and records a NotOwned Warning event when the field names a Secret it doesn't own.