cert-manager: certificate request is not approved

TL;DR

A CertificateRequest that never gets approved stalls the certificate: approve it with cmctl approve (or kubectl annotate), or fix the ClusterIssuer and approval policy blocking it. The certificate issues once the request is approved.

Error

cert-manager: certificate request is not approved

Steps

1. List the requests: run kubectl get certificaterequest and find the pending one. Expected: you see its age and that it is not approved.
2. Check the issuer: run kubectl describe clusterissuer (or issuer) for the referenced issuer and look at its status. Expected: the issuer is ready; a broken issuer explains the stall.
3. Approve manually: run cmctl approve on the CertificateRequest (or add the approve annotation). Expected: the request moves to approved.
4. Watch the certificate: the order or challenge flow should start once approved. Expected: the Certificate becomes ready.
5. For a durable fix, check the approval policy: some setups require manual approval by design, others auto-approve via an approver-policy. Expected: you know whether manual approval is expected or a misconfiguration.

When to use

• Certificates stuck pending with unapproved CertificateRequests
• After installing cert-manager with manual approval policies
• Debugging issuer chains

When not to use

• ACME HTTP01/DNS01 challenge failures (challenge layer)
• Issuer itself not ready (fix the issuer first)

Tool compatibility

• cert-manager (cmctl approve, CertificateRequest, Issuer/ClusterIssuer)

Variant phrasings

certificaterequest pending approval

Approve it manually or configure auto-approval; nothing proceeds until approval.

cert-manager issuer not approving

Check the issuer status and any approver-policy rules gating issuance.

Why it happens

cert-manager separates approval from issuance as a security control: the request object must be approved before the issuer acts. Manual-approval setups, broken approver webhooks, or misconfigured policies leave requests parked indefinitely.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cabIt0eW1kHdpMxjgAdKnw