// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manager/zero-trust-manager-plugins.adoc

:_mod-docs-content-type: CONCEPT
[id="zero-trust-manager-plugins-cert-manager-about_{context}"]
= About the cert-manager upstream authority plugin

[role="_abstract"]
The {cert-manager-operator} upstream authority plugin connects SPIRE Server to {cert-manager-operator} for automated intermediate certificate provisioning.

When you configure this plugin, SPIRE Server creates a `CertificateRequest` resource in the cluster. The configured Issuer or ClusterIssuer signs the request and the certificate. The SPIRE Server then uses the signed intermediate certificate to issue workload identities.

[id="cert-manager-plugin-workflow_{context}"]
== How the cert-manager plugin works

. SPIRE Server generates a certificate signing request for an intermediate signing certificate.
. The plugin creates a `CertificateRequest` in the configured namespace.
. The `CertificateRequest` references the configured Issuer or ClusterIssuer.
. {cert-manager-operator} signs the request.
. SPIRE Server retrieves the signed certificate and CA bundle from the `CertificateRequest`.

[id="cert-manager-plugin-requirements_{context}"]
== Requirements

{cert-manager-operator}:: {cert-manager-operator} must be installed and running in the cluster.
Issuer:: You must configure an `Issuer` or `ClusterIssuer` that can sign intermediate CA certificates.
Permissions:: On {product-title}, {zero-trust-full} grants the SPIRE Server `ServiceAccount` permission to manage `CertificateRequest` resources when `spec.upstreamAuthority.certManager` is configured. Prepare the Issuer and namespace before you configure the `SpireServer` CR.
Supported issuers:: The `Issuer` must support signing certificate requests for intermediate CAs.