How to fix certificate not ready in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 146 views

Certificate not ready errors occur when CertificateSigningRequest approval or signing fails. Fix by verifying CSR status, checking signer configuration, and approving pending requests.

Quick fix

Fixes certificate not ready

kubectl get csr
kubectl describe csr <csr-name>
  1. List and examine CSR status
  2. Approve pending CSR if needed
  3. Check CSR certificate field is populated
  4. Verify controller manager has CA files configured
kubernetes — error
kubectl get csr
kubectl describe csr <csr-name>
certificate not ready

What this error means

Kubernetes certificates are requested via CertificateSigningRequest (CSR) resources. When a certificate is "not ready," the CSR has been created but either not yet approved, approved but not signed by the signer, or failed to sign. This blocks TLS-based operations that depend on the certificate.

Typical symptoms

  • CSR shows Approved status but certificate field empty
  • CertificateSigningRequest status shows "Approved,Failed"
  • Certificate field in CSR status remains empty
  • Pods waiting for certificate mount to become available
  • TLS handshake failures due to missing certificates
  • Kubelet CSR approval process not completing
  • Certificate controller manager not running or unhealthy
  • Manual CSR approval not resulting in signed certificate

Common causes

  1. CSR not yet approved (pending administrator action)
  2. CSR approved but signer not configured or running
  3. Signer lacks CA certificate and private key files
  4. Invalid CSR format or signature algorithm not supported
  5. Signer node selector not matching any nodes
  6. API server controller manager not configured for auto-signing
  7. CA certificate or key file path incorrect
  8. CSR failed condition preventing signing

How to fix "certificate not ready"

1List and examine CSR status

View all CSRs and their status:

bash
kubectl get csr
kubectl describe csr <csr-name>

Look for status: Pending, Approved, or Failed condition.

2Approve pending CSR if needed

If CSR is Pending, manually approve it:

bash
kubectl certificate approve <csr-name>
kubectl get csr <csr-name> -o yaml | grep -A 2 conditions

After approval, the signer should issue the certificate.

3Check CSR certificate field is populated

After approval, verify certificate field has content:

bash
kubectl get csr <csr-name> -o jsonpath='{.status.certificate}'

If empty, the signer failed to issue the certificate.

4Verify controller manager has CA files configured

Check if kube-controller-manager is configured with CA:

bash
kubectl get deployment -n kube-system kube-controller-manager -o yaml | grep -i "cluster-signing"

Look for --cluster-signing-cert-file and --cluster-signing-key-file arguments.

5Check certificate signer configuration

List signers and their approval/signing rules:

bash
kubectl get csr -o jsonpath="{.items[*].spec.signerName}"

Common signers: kubernetes.io/kube-apiserver-client, kubernetes.io/kubelet-serving

6Review controller manager logs

Check logs for certificate signing errors:

bash
kubectl logs -n kube-system -l component=kube-controller-manager | grep -i cert

Look for missing CA files or signing operation failures.

7Verify CSR requestor has authorization

Ensure service account has permission to request certificates:

bash
kubectl auth can-i create certificatesigningrequests --as=system:serviceaccount:kube-system:kubelet
8Manually retrieve certificate after approval

Once approved and signed, extract certificate from CSR:

bash
kubectl get csr <csr-name> -o jsonpath='{.status.certificate}' | base64 -d > cert.crt
kubectl get csr <csr-name> -o jsonpath='{.status.certificate}' | base64 -d | openssl x509 -text

Advanced notes

For automated CSR approval, consider using RBAC-based auto-approval in clusters where security allows it. External signers (cert-manager, custom controllers) can be configured for specialized certificate needs. Always verify CA certificate validity - expired CA keys cannot sign new CSRs. For kubelet serving certificates, ensure the API server CSR signer has proper permissions. Monitor CSR resources continuously in large clusters for signing bottlenecks.

Frequently asked questions

What does "certificate not ready" mean?
Kubernetes certificates are requested via CertificateSigningRequest (CSR) resources. When a certificate is "not ready," the CSR has been created but either not yet approved, approved but not signed by the signer, or failed to sign. This blocks TLS-based operations that depend on the certificate.
How do I fix "certificate not ready"?
Certificate not ready errors occur when CertificateSigningRequest approval or signing fails. Fix by verifying CSR status, checking signer configuration, and approving pending requests.
What causes "certificate not ready"?
CSR not yet approved (pending administrator action) CSR approved but signer not configured or running Signer lacks CA certificate and private key files
Is the "certificate not ready" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading