# Operator not creating Issuer or Certificate

**URL:** <https://forums.percona.com/t/operator-not-creating-issuer-or-certificate/29567>\
**Category:** Percona Operator for MySQL\
**Created:** [April 5, 2024, 6:50pm UTC](https://forums.percona.com/t/operator-not-creating-issuer-or-certificate/29567 "2024-04-05T18:50:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dgloe](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@dgloe](https://forums.percona.com/u/dgloe)\
**Post date:** [April 5, 2024, 6:50pm UTC](https://forums.percona.com/t/operator-not-creating-issuer-or-certificate/29567/1 "2024-04-05T18:50:44Z")

</div>

## Description:

On one of our clusters, we noticed that the certificate expired, so we had to manually renew them. We do have cert-manager installed, so this wasn’t expected. If I remove the SSL secrets, the operator recreates them directly without creating an Issuer or Certificate. I’m guessing something is going wrong when it’s trying to use cert-manager, but I don’t see any indication of problems in the pxc-operator logs.

## Steps to Reproduce:

Follow [Transport Encryption (TLS/SSL) - Percona Operator for MySQL](https://docs.percona.com/percona-operator-for-mysql/pxc/TLS.html#update-certificates-with-downtime), then see new secrets created, but no cert-manager Issuer or Certificate resources.

## Version:

1.11.0

## Logs:

There are no logs or error messages in the pxc-operator pod about cert-manager or TLS.

## Expected Result:

I expect the operator to create new cert-manager Issuers and Certificates rather than creating the secrets directly. This works just fine on our other clusters.

## Actual Result:

The PXC operator creates the SSL secrets without cert-manager.

## Additional Information:

N/A

---

<div class="post-metadata">

**Author:** ![dgloe](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@dgloe](https://forums.percona.com/u/dgloe)\
**Post date:** [April 5, 2024, 7:22pm UTC](https://forums.percona.com/t/operator-not-creating-issuer-or-certificate/29567/2 "2024-04-05T19:22:20Z")

</div>

I think I figured this out. When I try to manually create the same Issuer as on another system, I get this error:

unable to recognize no matches for kind “Issuer” in version “[cert-manager.io/v1](http://cert-manager.io/v1)”

The version of cert-manager on the failing system is 0.14.1, which doesn’t have the v1 version of Issuer yet, just v1alpha2 and v1alpha3.

I think it would be nice to document the minimum required version of cert-manager (if it’s not already documented), and perhaps log an error or warning message showing why the operator isn’t using cert-manager for certificates. That would make it easier for others who run into this same problem.

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [April 5, 2024, 9:12pm UTC](https://forums.percona.com/t/operator-not-creating-issuer-or-certificate/29567/3 "2024-04-05T21:12:07Z")

</div>

Hello @dgloe,  
The documentation shows installing version 0.14.2

> **[Percona Operator for MySQL based on Percona XtraDB Cluster - Transport...](https://docs.percona.com/percona-operator-for-mysql/pxc/TLS.html#installation-of-the-cert-manager)**
>
> The Percona Operator for MySQL uses Transport Layer
> Security (TLS) cryptographic protocol for the following types of communication:

Does that version have the v1 Issuer?