tls-termination

# Skill: TLS Termination > **Expertise:** cert-manager ClusterIssuer, Let's Encrypt ACME (HTTP-01 + DNS-01), Vault PKI, cert rotation, mTLS. ## When to load When setting up TLS for a new service, debugging certificate issuance, rotating certificates, or implementing mTLS. ## cert-manager: Let's Encrypt (HTTP-01) ```yaml # ClusterIssuer — Let's Encrypt production apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: ops@example.com privateKeySecretRef: name: letsencrypt-prod-key solvers: - http01: ingress: class: nginx # must match ingressClassName in Ingress --- # Staging issuer (for testing — no rate limits) apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-staging spec: acme: server: https://acme-staging-v02.api.letsencrypt.org/directory email: ops@example.com privateKeySecretRef: name: letsencrypt-staging-key solvers: - http01: ingress: class: nginx ``` ## cert-manager: Let's Encrypt (DNS-01 — for wildcard certs) ```yaml # Requires DNS provider API credentials apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-dns spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: ops@example.com privateKeySecretRef: name: letsencrypt-dns-key solvers: - dns01: ...