A Certificate Foundation for the Homelab: cert-manager and a Cloudflare DNS-01 Wildcard Issuer

Overview

Both exposure tiers in this series terminate TLS at home on a publicly trusted wildcard certificate, and both mint that certificate the same way: cert-manager, issuing from Let's Encrypt through a Cloudflare DNS-01 challenge. This article builds that machinery once: it installs cert-manager and wires a DNS-01 ClusterIssuer that can prove domain control without a single inbound packet. It issues nothing yet: the private and public tiers each add their own wildcard on top of this issuer.