Discovering and Fixing a cert-manager Bug for the First Time in the World

The Devsisters Infra Cell encountered an issue while using Let's Encrypt certificates in a Kubernetes environment, where a certificate chain containing the expired DST Root CA X3 was being served, causing connection failures.

To resolve this, they explicitly specified a particular certificate chain via the preferredChain setting in cert-manager, but discovered a bug where this configuration value was ignored and the chain containing the expired CA continued to be returned.

Upon investigation, the cause was found to be a conflict between Let's Encrypt's cross-sign structure for backward compatibility and cert-manager's configuration handling logic. This issue proved critical especially in environments with libraries that strictly validate expired CAs, such as older versions of boringSSL.

After identifying the root cause through analysis, the issue was resolved through an open-source contribution, which corrected the problem where the certificate chain configuration was not working as intended.