Quick start

October 31, 2025 ยท View on GitHub

Before deploying the webhook you need to install cert-manager. You can find the official install instructions here.

  1. Create a read+write API token in the Hetzner Console as described in the official guide.

  2. Create a secret containing the API token. If you plan to create a namespace scoped Issuer, place the secret in the Issuers namespace. If you plan to configure a ClusterIssuer, place the secret in the configured cluster resource namespace, defaulting to cert-manager.

# secret.yml
apiVersion: v1
kind: Secret
metadata:
  name: hetzner
  namespace: cert-manager
stringData:
  token: <HETZNER_TOKEN>

Apply the secret:

kubectl apply -f secret.yml
  1. Add the Helm repository:
helm repo add hcloud https://charts.hetzner.cloud
helm repo update hcloud
  1. Install the webhook:
helm install cert-manager-webhook-hetzner hcloud/cert-manager-webhook-hetzner -n cert-manager

  1. Configure an Issuer or ClusterIssuer to suit your needs, as described in the official cert-manager documentation.

  2. Configure the Hetzner webhook as a DNS01 solver at your Issuer or ClusterIssuer (reference):

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: cluster-issuer
spec:
  acme:
    # [...]
    solvers:
      - dns01:
          webhook:
            solverName: hetzner
            groupName: acme.hetzner.com
            config:
              tokenSecretKeyRef:
                name: hetzner
                key: token
  1. You can now start requesting certificates.