- Shipped
- August 23, 2026 at 3:00 AM UTC
- Author
- Kamo
- Commit
- c9c2025
cleanup_orphan_certificates() listed with '-l auto-cert.kamo/fqdn'. That label is newer than the scanner certs the function exists to remove, so the selector excluded precisely its intended targets and it had never deleted anything: twenty certificates for baidu.com, spotify.com, qq.com and friends were still on the cluster, each a dead ACME order cert-manager retries forever against the shared Let's Encrypt account. List all certificates and fall back to spec.dnsNames when the label is absent, only for the single-dnsName shape auto-cert itself creates -- a multi-name certificate belongs to something else and is never guessed at. Every existing guard is unchanged: Ready certificates, static hosts and always-allow apexes are skipped, and deletion still requires the org registry to answer an explicit 404, never an error.