# What has to happen to a CertificateRequest before an issuer will sign it?

cert-manager, Hard (Expert), Security. https://k8wiz.com/uquiz/what-has-to-happen-to-a-certificaterequest-before-an-issuer-will-sign-it

- A. An administrator must approve every request with cmctl approve
- B. The requester's namespace must match the issuer's namespace
- C. Nothing, because issuers sign every request as soon as it exists
- D. It must get an Approved condition, which the built-in approver adds by default

**Answer:** It must get an Approved condition, which the built-in approver adds by default

**Explanation:** Issuers only sign CertificateRequests that carry an Approved condition and no Denied condition. By default the cert-manager controller approves every request for its built-in issuers. To control what can be requested, you turn off the built-in approver and run approver-policy, which approves or denies requests against CertificateRequestPolicy resources.