cert-manager

Define a ClusterIssuer with spec.acme pointing to the Let's Encrypt v02 server and a dns01 solver using cloudflare.apiTokenSecretRef referencing a Secret with your API token. Use apiTokenSecretRef, not apiKeySecretRef, since Cloudflare scoped tokens are required.

Create a Certificate resource with dnsNames containing the wildcard domain and reference a DNS-01 capable ClusterIssuer, since HTTP-01 cannot validate wildcards. Set duration and renewBefore so renewBefore stays shorter than duration to avoid constant renewal loops.

Yes, cert-manager v1.20+ supports Gateway API for ACME HTTP-01 via the gatewayHTTPRoute solver with parentRefs pointing to your Gateway. Earlier versions require an Ingress-based HTTP-01 solver with an ingress class.

Constant renewal usually happens when renewBefore is greater than or equal to duration, causing cert-manager to always consider the cert due for renewal. Set renewBefore well below duration, such as 720h renewBefore for a 2160h duration.

ECDSA with size 256 is recommended for performance and smaller keys. Use RSA with size 2048 only when older clients that lack ECDSA support must connect to your services.

Let's Encrypt production allows 50 certificates per week per domain, while staging allows 5 per week. Use the staging ACME server for testing to avoid exhausting production rate limits during development.