Cert manager letsencrypt only accepting default value for certificate , ignoring duration and renewBefore - ssl

Question

I am creating certificate using cert-manager (1.6.3). But the issue is , duration and renewBefore is not taking my custom values , instead it is taking the default value (90 days )
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: test-tls-com
namespace: api
spec:
issuerRef:
kind: ClusterIssuer
name: letsencrypt-prod
duration: 10h
renewBefore: 1h
commonName: "*.domain-name.in"
dnsNames:
- "*.domain-name.in"
secretName: test-tls-wild
But when I describe the certificate I can see Renewal Time is not matching
kubectl -n api describe cert test-tls-com
---
Not After: 2022-08-14T15:30:38Z
Not Before: 2022-05-16T15:30:39Z
Renewal Time: 2022-08-14T13:30:38Z <--it is not 1h renewal time
My cluster issuer looks like
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
namespace: cert-manager
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: xxx#gmail.com
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
solvers:
- dns01:
digitalocean:
tokenSecretRef:
name: digitalocean-dns
key: access-token
kubectl version
Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.5", GitCommit:"6b1d87acf3c8253c123756b9e61dac642678305f", GitTreeState:"clean", BuildDate:"2021-03-18T01:10:43Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.11", GitCommit:"38d3c1f3d5306401bcf39a71bad3b5a5106033d7", GitTreeState:"clean", BuildDate:"2022-03-16T14:02:06Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"}
Using the above configuration I am able to create certificate , but not sure why the Renewal Time is not matching with the duration and renewBefore

Answer 1

Renewal Time is not matching with the duration and renewBefore because The renewBefore and duration fields must be specified using a Go time.Duration string format, which does not allow the d (days) suffix. You must specify these values using s, m, and h suffixes instead.
Duration and RenewBefore should be as below in the YAML file as prescribed by cert-manager; then only it will match with renewal time and duration time.
Example :
duration: 2160h # 90d
renewBefore: 360h # 15d - custom dates we can give .