## TL;DR
kubeseal cannot reach the sealed-secrets controller to fetch its public cert: wrong controller name, wrong namespace, or wrong cluster context. Pass the right `--controller-name`, `--controller-namespace`, and context, and the fetch succeeds.

## Error
```text
kubeseal: error: cannot fetch certificate from controller
```

## Steps
1. Check your context: confirm kubectl points at the cluster running the controller. Expected: the right cluster, not a stale context.
2. Find the controller: list deployments or pods for the sealed-secrets controller and note its name and namespace. Expected: the real name and namespace, which often differ from defaults after custom installs.
3. Fetch with explicit flags: run kubeseal with the controller name and namespace you found. Expected: the certificate downloads.
4. Check RBAC: the fetching identity needs permission to read the controller's service or secret. Expected: no forbidden errors once the flags are right.
5. Save the certificate and use it for offline sealing. Expected: `kubeseal --cert` works without contacting the cluster.

## When to use
- kubeseal fails fetching the controller certificate
- Custom controller names or namespaces
- Sealing for a different cluster than your current context

## When not to use
- Sealing succeeds but the controller cannot decrypt (key mismatch)
- Controller not installed (install it first)

## Tool compatibility
- kubeseal CLI; sealed-secrets controller service

## Variant phrasings
### kubeseal wrong controller namespace
Pass `--controller-namespace` explicitly; the default only fits default installs.

### fetch cert wrong cluster
Switch kubectl context to the target cluster before fetching.

## Why it happens
kubeseal discovers the controller via the Kubernetes API using default name and namespace assumptions. Custom installs, multiple clusters, or a stale context break those assumptions, and the fetch fails before any crypto happens.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cBrRPiIEWj0MFwUkdPostA