// Module included in the following assemblies:
//
// * security/external_secrets_operator/external-secrets-operator-api.adoc

:_mod-docs-content-type: REFERENCE
[id="eso-cert-manager-config_{context}"]
= certManagerConfig

[role="_abstract"]
You can integrate the {external-secrets-operator} with cert-manager to secure internal webhooks. Use these settings to replace the default internal certificate management with cert-manager, specify custom issuers, and define certificate lifecycle and renewal policies.

[cols="1,1,1,1,1",options="header"]
|===
| Field
| Type
| Description
| Default
| Validation

| `mode`
| _string_
| `mode` specifies whether to use cert-manager for certificate management instead of the built-in `cert-controller` which can be indicated by setting either `Enabled` or `Disabled`. If set to `Enabled`, uses `cert-manager` for obtaining the certificates for the webhook server and other components. If set to `Disabled`, uses the `cert-controller` for obtaining the certificates for the webhook server. `Disabled` is the default behavior.
| 
| enum: [Enabled Disabled]

| `injectAnnotations`
| _string_
| `injectAnnotations` adds the `cert-manager.io/inject-ca-from` annotation to the webhooks and custom resource definitions (CRDs) to automatically configure the webhook with the `cert-manager` Operator certificate authority (CA). This requires CA Injector to be enabled in `cert-manager` Operator. Set this field to `true` or `false`. When set, this field cannot be changed.
| false
| enum: [true false]

| `issuerRef`
| _ObjectReference_
| `issuerRef` contains details of the referenced object used for obtaining certificates. The object must exist in the `external-secrets` namespace unless a cluster-scoped `cert-manager` Operator issuer is used.
|
| 

| `certificateDuration`
| link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta[_Duration_]
| `certificateDuration` sets the validity period of the webhook certificate.
| 8760h
| 

| `certificateRenewBefore`
| link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta[_Duration_]
| `certificateRenewBefore` sets the ahead time to renew the webhook certificate before expiry.
| 30m
| 
|===
