Hi @shubham14bajpai. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

👋 Thanks for updating, I've added a few more comments.

I'll also add the ok-to-test flag so you can use CI to run tests

/ok-to-test

👋 Thanks for updating, I've added a few more comments.

I'll also add the ok-to-test flag so you can use CI to run tests

/ok-to-test

Hey, sorry for the delay. I was finally able to fix the test failures. Please take another look.

Hiya! I'll take a look this week as soon as I have time

👋 Apologies for the delay - I've had a look at the code and it looks good. Given this area is not covered by tests I want to spin this up locally and do some manual testing before I approve.

👋 Apologies for the delay - I've had a look at the code and it looks good. Given this area is not covered by tests I want to spin this up locally and do some manual testing before I approve.

Hey I did some manual testing and here is the log 🙂

Created a webhook client

~/go/src/github/cert-manager on  add/webhook-auth! ⌚ 10:50:39
$ openssl x509 -text -noout -in /var/lib/minikube/certs/admission/webhook-client.crt 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:a3:56:1c:63:96:42:12:56:a3:92:20:9d:39:44:34:87:7d:12:5f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = minikubeCA
        Validity
            Not Before: Nov  8 04:58:00 2025 GMT
            Not After : Nov  8 04:58:00 2026 GMT
        Subject: CN = admission-webhook-client

Configured the kube-apiserver and cert-manager webhook

~/go/src/github/cert-manager on  add/webhook-auth! ⌚ 10:51:10
$ cat /etc/kubernetes/manifests/kube-apiserver.yaml | grep admission
    - --admission-control-config-file=/var/lib/minikube/certs/admission/admission-config.yaml

~/go/src/github/cert-manager on  add/webhook-auth! ⌚ 10:54:31
$ kubectl get -n cert-manager-dev deployment/cert-manager-dev-webhook -oyaml | grep client
        - --enable-client-verification=true
        - --client-ca-path=/var/lib/minikube/certs/ca.crt
        - --client-certificate-cn=admission-webhook-client

Tried curling the endpoints with & without the client certificate

~/go/src/github/cert-manager on  add/webhook-auth! ⌚ 10:56:20
$ kubectl exec -n cert-manager-dev curlpod2 -- curl -k --no-progress-meter --max-time 10 --cacert /tmp/ca.crt --cert /tmp/webhook-client.crt --key /tmp/webhook-client.key https://cert-manager-dev-webhook.cert-manager-dev.svc:443/mutate\?timeout\=1s
{"response":{"uid":"","allowed":false,"status":{"metadata":{},"message":"contentType=, expected application/json","code":400}}}

~/go/src/github/cert-manager on  add/webhook-auth! ⌚ 10:57:29
$ kubectl exec -n cert-manager-dev curlpod2 -- curl -k --no-progress-meter --max-time 10 https://cert-manager-dev-webhook.cert-manager-dev.svc:443/mutate\?timeout\=1s
curl: (56) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
command terminated with exit code 56

Tested the certificate generation

~/go/src/github/cert-manager on  add/webhook-auth! ⌚ 17:18:27
$ kubectl -n test-ns get issuer,certificate,secret
NAME                                 READY   AGE
issuer.cert-manager.io/test-issuer   True    82s

NAME                                    READY   SECRET          AGE
certificate.cert-manager.io/test-cert   True    test-cert-tls   82s

NAME                   TYPE                DATA   AGE
secret/test-cert-tls   kubernetes.io/tls   3      81s

👋 I have re-completed my testing after these changes and it all looks great! I have left one minor documentation comment just to clarify the apiserverClientCertSubjects Helm value, since thats just a comment update I can merge as soon as thats fixed.

I have included my testing notes below for documentation:

Setup

The following certificates were created for this test:

• ca.crt - A self-signed CA certificate
• valid-cn.crt - A client cert signed by the CA, with the CN being valid-client-name and no SANs
• valid-cn.key - Key for the above
• valid-dns.crt - A client cert signed by the CA, with the CN being invalid-client-name and a SAN of valid-client-name
• valid-dns.key - Key for the above
• invalid.crt - A client cert signed by the CA, with the CN being invalid-client-name and no SANs
• invalid.key - Key for the above

A kind cluster was created with this branch deployed using the e2e tooling, the certificates and keys were duplicated into the kind container using docker cp, additionally the CA was created as a Kubernetes secret.

For changes to the cert-manager config the helm-edit plugin was used to quickly change the Helm values.

Testing

Test 1 - Using Curl

This is the most thorough test of all configurations to ensure the server behaves as expected

Config 1 - Validating CA and CN/SAN

Helm config added from baseline:

webhook:
  apiserverClientCertSubjects: valid-client-name
  clientCAFile: /apiserver-webhook-client-ca/ca.crt
  enableClientVerification: true
  volumeMounts:
  - mountPath: /apiserver-webhook-client-ca
    name: apiserver-webhook-client-ca
  volumes:
  - name: apiserver-webhook-client-ca
    secret:
      secretName: apiserver-webhook-client-ca

Without certificate

root@kind-control-plane:/# curl -k https://10.0.207.228
curl: (56) OpenSSL SSL_read: OpenSSL/3.0.16: error:0A00045C:SSL routines::tlsv13 alert certificate required, errno 0

Blocks the request as expected

With certificate signed by correct CA with correct CN and no SAN

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /testing/valid-cn.crt --key  /testing/valid-cn.key
404 page not found

Allows the request as expected

With certificate signed by correct CA with incorrect CN correct SAN

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /testing/valid-dns.crt --key  /testing/valid-dns.key
404 page not found

Allows the request as expected

With certificate signed by correct CA with incorrect CN and no SAN

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /testing/invalid.crt --key  /testing/invalid.key
curl: (56) OpenSSL SSL_read: OpenSSL/3.0.16: error:0A000412:SSL routines::sslv3 alert bad certificate, errno 0

Blocks the request as expected

With certificate signed by incorrect CA

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key  /etc/kubernetes/pki/apiserver-etcd-client.key
curl: (56) OpenSSL SSL_read: OpenSSL/3.0.16: error:0A000418:SSL routines::tlsv1 alert unknown ca, errno 0

Blocks the request as expected

Config 2 - Validating CA with any CN

Helm config added from baseline:

webhook:
  clientCAFile: /apiserver-webhook-client-ca/ca.crt
  enableClientVerification: true
  volumeMounts:
  - mountPath: /apiserver-webhook-client-ca
    name: apiserver-webhook-client-ca
  volumes:
  - name: apiserver-webhook-client-ca
    secret:
      secretName: apiserver-webhook-client-ca

Without certificate

root@kind-control-plane:/# curl -k https://10.0.207.228
curl: (56) OpenSSL SSL_read: OpenSSL/3.0.16: error:0A00045C:SSL routines::tlsv13 alert certificate required, errno 0

Blocks the request as expected

With certificate signed by correct CA with correct CN and no SAN

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /testing/valid-cn.crt --key  /testing/valid-cn.key
404 page not found

Allows the request as expected

With certificate signed by correct CA with incorrect CN correct SAN

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /testing/valid-dns.crt --key  /testing/valid-dns.key
404 page not found

Allows the request as expected

With certificate signed by correct CA with incorrect CN and no SAN

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /testing/invalid.crt --key  /testing/invalid.key
404 page not found

Allows the request as expected

With certificate signed by incorrect CA

root@kind-control-plane:/# curl -k https://10.0.207.228 --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key  /etc/kubernetes/pki/apiserver-etcd-client.key
curl: (56) OpenSSL SSL_read: OpenSSL/3.0.16: error:0A000418:SSL routines::tlsv1 alert unknown ca, errno 0

Blocks the request as expected

Test 2 - Using the APIServer

This is a simple happy path test to ensure the APIServer can still hit the webhook, the APIServer is set up to use the valid-cn.crt as its client certificate using an AdmissionConfiguration:

cat <<EOF | kubectl apply -f - --dry-run=server
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: webhook-test-cert
  namespace: default
spec:
  secretName: webhook-test-tls
  duration: 2160h    # 90 days
  renewBefore: 360h  # 15 days
  subject:
    organizations:
      - example-org
  commonName: webhook-test.example.com
  dnsNames:
    - webhook-test.example.com
    - alt-webhook-test.example.com
  issuerRef:
    name: test-issuer
    kind: Issuer
EOF
Warning: spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`.
certificate.cert-manager.io/webhook-test-cert created (server dry run)

The webhook is the thing setting the "warning", proving it was invoked correctly.

Thank you so much for the detailed testing 🙏

Thats great! Thanks for contributing this 🙂

/lgtm
/approve

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ThatsMrTalbot

The full list of commands accepted by this bot can be found here.

The pull request process is described here