## TL;DR
A `CertificateRequest` that never gets approved stalls the certificate: approve it with `cmctl approve` (or kubectl annotate), or fix the ClusterIssuer and approval policy blocking it. The certificate issues once the request is approved.

## Error
```text
cert-manager: certificate request is not approved
```

## Steps
1. List the requests: run `kubectl get certificaterequest` and find the pending one. Expected: you see its age and that it is not approved.
2. Check the issuer: run `kubectl describe clusterissuer` (or issuer) for the referenced issuer and look at its status. Expected: the issuer is ready; a broken issuer explains the stall.
3. Approve manually: run `cmctl approve` on the CertificateRequest (or add the approve annotation). Expected: the request moves to approved.
4. Watch the certificate: the order or challenge flow should start once approved. Expected: the Certificate becomes ready.
5. For a durable fix, check the approval policy: some setups require manual approval by design, others auto-approve via an approver-policy. Expected: you know whether manual approval is expected or a misconfiguration.

## When to use
- Certificates stuck pending with unapproved CertificateRequests
- After installing cert-manager with manual approval policies
- Debugging issuer chains

## When not to use
- ACME HTTP01/DNS01 challenge failures (challenge layer)
- Issuer itself not ready (fix the issuer first)

## Tool compatibility
- cert-manager (`cmctl approve`, CertificateRequest, Issuer/ClusterIssuer)

## Variant phrasings
### certificaterequest pending approval
Approve it manually or configure auto-approval; nothing proceeds until approval.

### cert-manager issuer not approving
Check the issuer status and any approver-policy rules gating issuance.

## Why it happens
cert-manager separates approval from issuance as a security control: the request object must be approved before the issuer acts. Manual-approval setups, broken approver webhooks, or misconfigured policies leave requests parked indefinitely.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cabIt0eW1kHdpMxjgAdKnw