When a cert-manager Keystore Runs Behind a Password Change

cert-manager v1.21.2's API reference: "The keystore file will be updated immediately." After a password change, the keystores opened only with the old password throughout our 30-minute window.

When It Runs — Run Report #RR08 · Testing what infrastructure actually does.

Provider · Component: cert-manager · the keystore outputs of a Certificate (spec.keystores.jks / spec.keystores.pkcs12 with create: true) — what the keystore entries in the target Secret hold after the keystore password is changed

Versions tested: measured — cert-manager v1.21.2 (current supported release; latest as of 2026-09-11; single version). source-read — the v1.21.2 tag. quoted, not measured — the same API comment at the v1.10.0 and v1.11.0 tags.

Config profile: a single-node kind cluster (node kindest/node:v1.33.4, digest-pinned) on a dedicated test environment; a SelfSigned Issuer → Certificates with keystores.jks and keystores.pkcs12 (profile: Modern2023), both create: true; the keystore password supplied through passwordSecretRef (two Certificates) or the inline password field (one Certificate); the password changed in place (the referenced Secret updated, the inline field patched); 30-second polling; an observation window of ≥30 minutes; then a manual re-issuance with cmctl renew.

Verified on: 2026-10-13 (desk sources re-checked; cert-manager v1.21.2 was the latest release) · lab measured 2026-09-26 on v1.21.2.

Affects: cert-manager v1.21.2 Certificates with keystores.jks or keystores.pkcs12 set to create: true: after the keystore password is changed — in the Secret referenced by passwordSecretRef, or in the inline password field — the keystore entries in the target Secret stay encrypted with the previous password until the certificate is next issued (observed for the 30-minute window we watched; beyond it, from the source), while the Certificate stays Ready=True.

TL;DR: On cert-manager v1.21.2, after the keystore password was changed in the Secret referenced by passwordSecretRef (or in the inline password field), keystore.jks and keystore.p12 in the target Secret still opened only with the old password for the whole 30-minute window we watched, while the Certificate stayed Ready; re-issuing the certificate switched them to the new password — yet the API reference says the keystore file "will be updated immediately."

Full report: https://whenitruns.substack.com/p/when-a-cert-manager-keystore-runs

Reproduction repo: https://github.com/whenitruns/when-a-cert-manager-keystore-runs-behind-a-password-change