Speaking about automating TLS Certificates with Cert-Manager at The Hack Summit 2026

I am presenting a second session at The Hack Summit 2026! My session, “Set It and Forget It: Secure & Automated Certificate Management on AKS,” releases on November 5th, 2026 as an on-demand VOD presentation.

With certificate lifespans continuously shrinking, manual certificate rotation is no longer just an inconvenience—it is a major operational liability that leads to unexpected production downtime. In cloud-native environments, automated TLS certificate lifecycle management is a fundamental security requirement.

In this deep dive, I walk through building a “Gold Standard” automated certificate pipeline on Azure Kubernetes Service (AKS) using cert-manager and a zero-secret security model.

Key Topics Covered

• Validation Mechanics: A detailed breakdown of HTTP-01 versus DNS-01 validation challenges, including why DNS-01 is essential for issuing wildcard certificates.
• Zero-Secret Identity Model: Leveraging Azure Workload Identity to grant cert-manager access to Azure DNS without managing long-lived secrets or credentials.
• Dynamic Ephemeral Environments: How to configure automated renewals and on-demand provisioning for short-lived pull request deployments.
• Ingress & Gateway API Integration: Practical technical steps to connect automated certificate issuance with both traditional Ingress controllers and the modern Kubernetes Gateway API.

Say goodbye to expired production certificates and late-night emergency renewals by building a completely hands-off certificate lifecycle.

Stream the session on-demand starting November 5th at The Hack Summit 2026.

The abstract for my session is as follows:

Set It and Forget It: Secure & Automated Certificate Management on AKS

Manual certificate rotation has become a significant operational liability. In an era of shrinking certificate lifespans and increasing cluster complexity, traditional manual methods are no longer a viable way to maintain production uptime. Automation has transitioned from a luxury to a fundamental security requirement for modern cloud-native environments.

This session breaks down the implementation of a modern “Gold Standard” for certificate management on Azure Kubernetes Service, explaining the mechanics of both HTTP-01 and DNS-01 validation challenges while detailing the practical differences between specific and wildcard certificates.

The presentation demonstrates a secure, zero-secret identity model using Azure Workload Identity to grant Cert-Manager access to Azure DNS without managing long-lived credentials.

Attendees will gain a technical understanding of the mechanics behind the DNS-01 challenge and why it is the essential method for issuing wildcard certificates. The discussion also covers how to configure automated renewals and on-demand provisioning, enabling advanced workflows such as dynamic certificate creation for ephemeral environments during pull request deployments.

By the end of the session, participants will have the specific technical knowledge required to integrate these automated systems with both Ingress and the Gateway API, allowing them to build and maintain a fully automated, hands-off certificate lifecycle.