cert-manager
Hard
Security
What does privateKey.rotationPolicy: Always do on a Certificate?
Select your answer:
Show answer and explanation
Answer: A new private key is generated on every issuance and renewal
Explanation
With Always, each issuance creates a fresh key, so a leaked key stops being useful after the next renewal. With Never, cert-manager reuses the key already stored in the Secret. Always has been the default since cert-manager v1.18. Before that the default was Never.
More hard cert-manager questions
- How do you make cert-manager reissue a certificate right away, before it is due for renewal?
- What does the Secret named in an ACME issuer's privateKeySecretRef contain?
- Let's Encrypt fails HTTP-01 validation for app.example.com. Which URL must be reachable from the internet?
- A Certificate fails to issue several times in a row, for example because the issuer is misconfigured. How does cert-manager retry?
- Which cert-manager sub-project copies CA bundles into namespaces as ConfigMaps or Secrets, so applications can trust a private CA?
- Which cert-manager component issues a certificate straight into a pod's volume without creating a Secret?