When cert-manager's Ready Condition Runs Past Expiry Until a Reconcile

On cert-manager v1.21.2, a renewal-blocked Certificate kept Ready=True ("Certificate is up to date and has not expired") past notAfter through our 30-minute window, until a restart reconciled it.

When It Runs — Run Report #RR10 · Testing what infrastructure actually does.

Provider · Component: cert-manager · the Certificate Ready condition (readiness controller) after status.notAfter has passed, when renewal is blocked

Versions tested: measured — cert-manager v1.21.2 (the latest release as of 2026-09-11; v1.21.3, released on 2026-10-23, was not measured; single version). reported — v1.18.2 (issue #7895; a report-layer detail, not measured here). source-read — the v1.21.2 tag.

Config profile: a single-node kind cluster (node kindest/node:v1.33.4, digest-pinned) on a dedicated test environment; a SelfSigned Issuer → a Certificate (duration: 1h, renewBefore: 55m, RSA-2048); renewal blocked by deleting the Issuer after issuance (a block that generates no further events); 30-second polling; an observation window of ≥30 minutes past notAfter; then a controller restart.

Verified on: 2026-10-23 (desk sources re-checked; PR #8529 open and unmerged, and v1.21.3 the latest release) · lab measured 2026-09-28 on v1.21.2.

Affects: cert-manager v1.21.2 Certificates whose renewal is blocked and whose state produces no further change events on the Certificate, its Secret, or its CertificateRequest (measured here: the Issuer was deleted; reported elsewhere: e.g. an ACME DNS01 failure): after status.notAfter passes, Ready=True and the message "Certificate is up to date and has not expired" can remain until the next reconcile (an event, the informer resync, or a restart). The length of that window is only what we measured, within this condition.

TL;DR: On cert-manager v1.21.2, a renewal-blocked 1-hour Certificate stayed READY=True with "Certificate is up to date and has not expired" for the whole 30-minute window we watched after the certificate in its Secret had actually expired, and changed to Ready=False ("Certificate expired on …") only after the controller was restarted, about 34 minutes past expiry — while the API defines Ready to mean, among other things, "a certificate that has not expired."

Full report: https://whenitruns.substack.com/p/when-cert-managers-ready-condition

Reproduction repo: https://github.com/whenitruns/when-cert-managers-ready-condition-runs-past-expiry-until-a-reconcile