Repository: jetstack/cert-manager
Pull request #4753 (2022-01-17 12:07:09)

Add kubebuilder tools in make for integration tests
Note that darwin/arm64 has to be special cased currently because of a lack of official support for that platform in upstream etcd and kube-apiserver. We instead install the amd64 versions, which is what we did [for bazel](https://github.com/jetstack/cert-manager/blob/42d358d69b59f52d6ebc539fa382bb16b5c34e56/hack/bin/BUILD.bazel#L17-L27).

Testers with M1 macs would be especially valuable for this PR!

/kind feature

```release-note
NONE
```



Patch:
diff --git a/deploy/crds/crd-certificates.yaml b/deploy/crds/crd-certificates.yaml
index d14fef18d..d57717f11 100644
--- a/deploy/crds/crd-certificates.yaml
+++ b/deploy/crds/crd-certificates.yaml
@@ -68,16 +68,16 @@ spec:
                 - secretName
               properties:
                 additionalOutputFormats:
-                  description: AdditionalOutputFormats defines extra output formats of the private key and signed certificate chain to be written to this Certificate's target Secret. This is an Alpha Feature and is only enabled with the `--feature-gates=AdditionalCertificateOutputFormats=true` option.
+                  description: AdditionalOutputFormats allows for requests of additional output formats of the private key and the certificate to be written to the secret. This is an Alpha Feature and should be enabled with --feature-gates option.
                   type: array
                   items:
-                    description: CertificateAdditionalOutputFormat defines an additional output format of a Certificate resource. These contain supplementary data formats of the signed certificate chain and paired private key.
+                    description: AdditionalOutputFormat wraps an additional output format type
                     type: object
                     required:
                       - type
                     properties:
                       type:
-                        description: Type is the name of the format type that should be written to the Certificate's target Secret.
+                        description: OutputFormatType specifies which additional output formats should be added to Kubernetes secrets. Allowed values are `DER` or `CombinedPEM`. When Type is set to `DER` an additional entry `key.der` will be created in the secret containing the binary format of the key. When Type is set to `CombinedPEM` an additional entry `tls-combined.pem` will be created in the secret containing the PEM formatted certificate chain and key (tls.key + tls.crt concatenated)
                         type: string
                         enum:
                           - DER
diff --git a/internal/apis/certmanager/types_certificate.go b/internal/apis/certmanager/types_certificate.go
index 72d481819..795ff8bf3 100644
--- a/internal/apis/certmanager/types_certificate.go
+++ b/internal/apis/certmanager/types_certificate.go
@@ -166,11 +166,10 @@ type CertificateSpec struct {
 	// revisions will not be garbage collected. Default value is `nil`.
 	RevisionHistoryLimit *int32
 
-	// AdditionalOutputFormats defines extra output formats of the private key
-	// and signed certificate chain to be written to this Certificate's target
-	// Secret. This is an Alpha Feature and is only enabled with the
-	// `--feature-gates=AdditionalCertificateOutputFormats=true` option.
-	AdditionalOutputFormats []CertificateAdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
+	// AdditionalOutputFormats allows for requests of additional output formats
+	// of the private key and the certificate to be written to the secret.
+	// This is an Alpha Feature and should be enabled with --feature-gates option.
+	AdditionalOutputFormats []AdditionalOutputFormat
 }
 
 // CertificatePrivateKey contains configuration options for private keys
@@ -211,37 +210,27 @@ type CertificatePrivateKey struct {
 	Size int
 }
 
-// CertificateOutputFormatType specifies which additional output formats should
-// be written to the Certificate's target Secret.
+// OutputFormatType specifies which additional output formats should be added to Kubernetes secrets.
 // Allowed values are `DER` or `CombinedPEM`.
-// When Type is set to `DER` an additional entry `key.der` will be written to
-// the Secret, containing the binary format of the private key.
-// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem`
-// will be written to the Secret, containing the PEM formatted private key and
-// signed certificate chain (tls.key + tls.crt concatenated).
-type CertificateOutputFormatType string
+// When Type is set to `DER` an additional entry `key.der` will be created in the secret
+// containing the binary format of the key.
+// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem` will be created in the secret
+// containing the PEM formatted certificate chain and key (tls.key + tls.crt concatenated)
+type OutputFormatType string
 
 const (
-	// AdditionalCertificateOutputFormatDER  writes the Certificate's private key
-	// in DER binary format to the `key.der` target Secret Data key.
-	AdditionalCertificateOutputFormatDER CertificateOutputFormatType = "DER"
-
-	// AdditionalCertificateOutputFormatCombinedPEM  writes the Certificate's
-	// signed certificate chain and private key, in PEM format, to the
-	// `tls-combined.pem` target Secret Data key. The value at this key will
-	// include the private key PEM document, followed by at least one new line
-	// character, followed by the chain of signed certificate PEM documents
-	// (`<private key> + \n + <signed certificate chain>`).
-	AdditionalCertificateOutputFormatCombinedPEM CertificateOutputFormatType = "CombinedPEM"
+	// AdditionalOutputFormatDER requests that the DER binary format of the key
+	// is stored in the `key.der` key of a secret
+	AdditionalOutputFormatDER OutputFormatType = "DER"
+
+	// AdditionalOutputFormatCombinedPEM requests that an entry containing both the PEM tls.crt and tls.key
+	// values concatenated is stored in the `tls-combined.pem` key of a secret
+	AdditionalOutputFormatCombinedPEM OutputFormatType = "CombinedPEM"
 )
 
-// CertificateAdditionalOutputFormat defines an additional output format of a
-// Certificate resource. These contain supplementary data formats of the signed
-// certificate chain and paired private key.
-type CertificateAdditionalOutputFormat struct {
-	// Type is the name of the format type that should be written to the
-	// Certificate's target Secret.
-	Type CertificateOutputFormatType `json:"type"`
+// AdditionalOutputFormat wraps an additional output format type
+type AdditionalOutputFormat struct {
+	Type OutputFormatType
 }
 
 // Denotes how private keys should be generated or sourced when a Certificate
diff --git a/internal/apis/certmanager/v1/zz_generated.conversion.go b/internal/apis/certmanager/v1/zz_generated.conversion.go
index 0b132fed6..41680fb7f 100644
--- a/internal/apis/certmanager/v1/zz_generated.conversion.go
+++ b/internal/apis/certmanager/v1/zz_generated.conversion.go
@@ -44,6 +44,16 @@ func init() {
 // RegisterConversions adds conversion functions to the given scheme.
 // Public to allow building arbitrary schemes.
 func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*v1.AdditionalOutputFormat)(nil), (*certmanager.AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(a.(*v1.AdditionalOutputFormat), b.(*certmanager.AdditionalOutputFormat), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*certmanager.AdditionalOutputFormat)(nil), (*v1.AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_AdditionalOutputFormat_To_v1_AdditionalOutputFormat(a.(*certmanager.AdditionalOutputFormat), b.(*v1.AdditionalOutputFormat), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddGeneratedConversionFunc((*v1.CAIssuer)(nil), (*certmanager.CAIssuer)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1_CAIssuer_To_certmanager_CAIssuer(a.(*v1.CAIssuer), b.(*certmanager.CAIssuer), scope)
 	}); err != nil {
@@ -64,16 +74,6 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*v1.CertificateAdditionalOutputFormat)(nil), (*certmanager.CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(a.(*v1.CertificateAdditionalOutputFormat), b.(*certmanager.CertificateAdditionalOutputFormat), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*certmanager.CertificateAdditionalOutputFormat)(nil), (*v1.CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_certmanager_CertificateAdditionalOutputFormat_To_v1_CertificateAdditionalOutputFormat(a.(*certmanager.CertificateAdditionalOutputFormat), b.(*v1.CertificateAdditionalOutputFormat), scope)
-	}); err != nil {
-		return err
-	}
 	if err := s.AddGeneratedConversionFunc((*v1.CertificateCondition)(nil), (*certmanager.CertificateCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1_CertificateCondition_To_certmanager_CertificateCondition(a.(*v1.CertificateCondition), b.(*certmanager.CertificateCondition), scope)
 	}); err != nil {
@@ -387,6 +387,26 @@ func RegisterConversions(s *runtime.Scheme) error {
 	return nil
 }
 
+func autoConvert_v1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *v1.AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = certmanager.OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_v1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_v1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *v1.AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_v1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in, out, s)
+}
+
+func autoConvert_certmanager_AdditionalOutputFormat_To_v1_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *v1.AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = v1.OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_certmanager_AdditionalOutputFormat_To_v1_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_certmanager_AdditionalOutputFormat_To_v1_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *v1.AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_certmanager_AdditionalOutputFormat_To_v1_AdditionalOutputFormat(in, out, s)
+}
+
 func autoConvert_v1_CAIssuer_To_certmanager_CAIssuer(in *v1.CAIssuer, out *certmanager.CAIssuer, s conversion.Scope) error {
 	out.SecretName = in.SecretName
 	out.CRLDistributionPoints = *(*[]string)(unsafe.Pointer(&in.CRLDistributionPoints))
@@ -443,26 +463,6 @@ func Convert_certmanager_Certificate_To_v1_Certificate(in *certmanager.Certifica
 	return autoConvert_certmanager_Certificate_To_v1_Certificate(in, out, s)
 }
 
-func autoConvert_v1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *v1.CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = certmanager.CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_v1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_v1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *v1.CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_v1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in, out, s)
-}
-
-func autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *v1.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = v1.CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_certmanager_CertificateAdditionalOutputFormat_To_v1_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_certmanager_CertificateAdditionalOutputFormat_To_v1_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *v1.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1_CertificateAdditionalOutputFormat(in, out, s)
-}
-
 func autoConvert_v1_CertificateCondition_To_certmanager_CertificateCondition(in *v1.CertificateCondition, out *certmanager.CertificateCondition, s conversion.Scope) error {
 	out.Type = certmanager.CertificateConditionType(in.Type)
 	out.Status = meta.ConditionStatus(in.Status)
@@ -833,7 +833,7 @@ func autoConvert_v1_CertificateSpec_To_certmanager_CertificateSpec(in *v1.Certif
 	out.PrivateKey = (*certmanager.CertificatePrivateKey)(unsafe.Pointer(in.PrivateKey))
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]certmanager.CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]certmanager.AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
@@ -865,7 +865,7 @@ func autoConvert_certmanager_CertificateSpec_To_v1_CertificateSpec(in *certmanag
 	out.PrivateKey = (*v1.CertificatePrivateKey)(unsafe.Pointer(in.PrivateKey))
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]v1.CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]v1.AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
diff --git a/internal/apis/certmanager/v1alpha2/types_certificate.go b/internal/apis/certmanager/v1alpha2/types_certificate.go
index d64e3d394..98c02aab6 100644
--- a/internal/apis/certmanager/v1alpha2/types_certificate.go
+++ b/internal/apis/certmanager/v1alpha2/types_certificate.go
@@ -209,12 +209,11 @@ type CertificateSpec struct {
 	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"` // Validated by the validating webhook.
 
-	// AdditionalOutputFormats defines extra output formats of the private key
-	// and signed certificate chain to be written to this Certificate's target
-	// Secret. This is an Alpha Feature and is only enabled with the
-	// `--feature-gates=AdditionalCertificateOutputFormats=true` option.
+	// AdditionalOutputFormats allows for requests of additional output formats
+	// of the private key and the certificate to be written to the secret.
+	// This is an Alpha Feature and should be enabled with --feature-gates option.
 	// +optional
-	AdditionalOutputFormats []CertificateAdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
+	AdditionalOutputFormats []AdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
 }
 
 // CertificatePrivateKey contains configuration options for private keys
@@ -450,36 +449,26 @@ type CertificateSecretTemplate struct {
 	Labels map[string]string `json:"labels,omitempty"`
 }
 
-// CertificateOutputFormatType specifies which output formats that can be
-// written to the Certificate's target Secret.
+// OutputFormatType specifies which additional output formats should be added to Kubernetes secrets.
 // Allowed values are `DER` or `CombinedPEM`.
-// When Type is set to `DER` an additional entry `key.der` will be written to
-// the Secret, containing the binary format of the private key.
-// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem`
-// will be written to the Secret, containing the PEM formatted private key and
-// signed certificate chain (tls.key + tls.crt concatenated).
+// When Type is set to `DER` an additional entry `key.der` will be created in the secret
+// containing the binary format of the key.
+// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem` will be created in the secret
+// containing the PEM formatted certificate chain and key (tls.key + tls.crt concatenated)
 // +kubebuilder:validation:Enum=DER;CombinedPEM
-type CertificateOutputFormatType string
+type OutputFormatType string
 
 const (
-	// CertificateOutputFormatDER  writes the Certificate's private key in DER
-	// binary format to the `key.der` target Secret Data key.
-	CertificateOutputFormatDER CertificateOutputFormatType = "DER"
-
-	// CertificateOutputFormatCombinedPEM  writes the Certificate's signed
-	// certificate chain and private key, in PEM format, to the
-	// `tls-combined.pem` target Secret Data key. The value at this key will
-	// include the private key PEM document, followed by at least one new line
-	// character, followed by the chain of signed certificate PEM documents
-	// (`<private key> + \n + <signed certificate chain>`).
-	CertificateOutputFormatCombinedPEM CertificateOutputFormatType = "CombinedPEM"
+	// AdditionalOutputFormatDER requests that the DER binary format of the key
+	// is stored in the `key.der` key of a secret
+	AdditionalOutputFormatDER OutputFormatType = "DER"
+
+	// AdditionalOutputFormatCombinedPEM requests that an entry containing both the PEM tls.crt and tls.key
+	// values concatenated is stored in the `tls-combined.pem` key of a secret
+	AdditionalOutputFormatCombinedPEM OutputFormatType = "CombinedPEM"
 )
 
-// CertificateAdditionalOutputFormat defines an additional output format of a
-// Certificate resource. These contain supplementary data formats of the signed
-// certificate chain and paired private key.
-type CertificateAdditionalOutputFormat struct {
-	// Type is the name of the format type that should be written to the
-	// Certificate's target Secret.
-	Type CertificateOutputFormatType `json:"type"`
+// AdditionalOutputFormat wraps an additional key output format type
+type AdditionalOutputFormat struct {
+	Type OutputFormatType `json:"type"`
 }
diff --git a/internal/apis/certmanager/v1alpha2/zz_generated.conversion.go b/internal/apis/certmanager/v1alpha2/zz_generated.conversion.go
index b697f370c..f2f14fdfa 100644
--- a/internal/apis/certmanager/v1alpha2/zz_generated.conversion.go
+++ b/internal/apis/certmanager/v1alpha2/zz_generated.conversion.go
@@ -47,28 +47,28 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*certmanager.CAIssuer)(nil), (*CAIssuer)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_certmanager_CAIssuer_To_v1alpha2_CAIssuer(a.(*certmanager.CAIssuer), b.(*CAIssuer), scope)
+	if err := s.AddGeneratedConversionFunc((*AdditionalOutputFormat)(nil), (*certmanager.AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1alpha2_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(a.(*AdditionalOutputFormat), b.(*certmanager.AdditionalOutputFormat), scope)
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*Certificate)(nil), (*certmanager.Certificate)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha2_Certificate_To_certmanager_Certificate(a.(*Certificate), b.(*certmanager.Certificate), scope)
+	if err := s.AddGeneratedConversionFunc((*certmanager.AdditionalOutputFormat)(nil), (*AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_AdditionalOutputFormat_To_v1alpha2_AdditionalOutputFormat(a.(*certmanager.AdditionalOutputFormat), b.(*AdditionalOutputFormat), scope)
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*certmanager.Certificate)(nil), (*Certificate)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_certmanager_Certificate_To_v1alpha2_Certificate(a.(*certmanager.Certificate), b.(*Certificate), scope)
+	if err := s.AddGeneratedConversionFunc((*certmanager.CAIssuer)(nil), (*CAIssuer)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_CAIssuer_To_v1alpha2_CAIssuer(a.(*certmanager.CAIssuer), b.(*CAIssuer), scope)
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*CertificateAdditionalOutputFormat)(nil), (*certmanager.CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha2_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(a.(*CertificateAdditionalOutputFormat), b.(*certmanager.CertificateAdditionalOutputFormat), scope)
+	if err := s.AddGeneratedConversionFunc((*Certificate)(nil), (*certmanager.Certificate)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1alpha2_Certificate_To_certmanager_Certificate(a.(*Certificate), b.(*certmanager.Certificate), scope)
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*certmanager.CertificateAdditionalOutputFormat)(nil), (*CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha2_CertificateAdditionalOutputFormat(a.(*certmanager.CertificateAdditionalOutputFormat), b.(*CertificateAdditionalOutputFormat), scope)
+	if err := s.AddGeneratedConversionFunc((*certmanager.Certificate)(nil), (*Certificate)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_Certificate_To_v1alpha2_Certificate(a.(*certmanager.Certificate), b.(*Certificate), scope)
 	}); err != nil {
 		return err
 	}
@@ -385,6 +385,26 @@ func RegisterConversions(s *runtime.Scheme) error {
 	return nil
 }
 
+func autoConvert_v1alpha2_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = certmanager.OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_v1alpha2_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_v1alpha2_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_v1alpha2_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in, out, s)
+}
+
+func autoConvert_certmanager_AdditionalOutputFormat_To_v1alpha2_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_certmanager_AdditionalOutputFormat_To_v1alpha2_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_certmanager_AdditionalOutputFormat_To_v1alpha2_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_certmanager_AdditionalOutputFormat_To_v1alpha2_AdditionalOutputFormat(in, out, s)
+}
+
 func autoConvert_v1alpha2_CAIssuer_To_certmanager_CAIssuer(in *CAIssuer, out *certmanager.CAIssuer, s conversion.Scope) error {
 	out.SecretName = in.SecretName
 	out.CRLDistributionPoints = *(*[]string)(unsafe.Pointer(&in.CRLDistributionPoints))
@@ -441,26 +461,6 @@ func Convert_certmanager_Certificate_To_v1alpha2_Certificate(in *certmanager.Cer
 	return autoConvert_certmanager_Certificate_To_v1alpha2_Certificate(in, out, s)
 }
 
-func autoConvert_v1alpha2_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = certmanager.CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_v1alpha2_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_v1alpha2_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_v1alpha2_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in, out, s)
-}
-
-func autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha2_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha2_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha2_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha2_CertificateAdditionalOutputFormat(in, out, s)
-}
-
 func autoConvert_v1alpha2_CertificateCondition_To_certmanager_CertificateCondition(in *CertificateCondition, out *certmanager.CertificateCondition, s conversion.Scope) error {
 	out.Type = certmanager.CertificateConditionType(in.Type)
 	out.Status = meta.ConditionStatus(in.Status)
@@ -833,7 +833,7 @@ func autoConvert_v1alpha2_CertificateSpec_To_certmanager_CertificateSpec(in *Cer
 	}
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]certmanager.CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]certmanager.AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
@@ -881,7 +881,7 @@ func autoConvert_certmanager_CertificateSpec_To_v1alpha2_CertificateSpec(in *cer
 	}
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
diff --git a/internal/apis/certmanager/v1alpha2/zz_generated.deepcopy.go b/internal/apis/certmanager/v1alpha2/zz_generated.deepcopy.go
index 9dc0f24eb..6033dc64e 100644
--- a/internal/apis/certmanager/v1alpha2/zz_generated.deepcopy.go
+++ b/internal/apis/certmanager/v1alpha2/zz_generated.deepcopy.go
@@ -28,6 +28,22 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AdditionalOutputFormat) DeepCopyInto(out *AdditionalOutputFormat) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalOutputFormat.
+func (in *AdditionalOutputFormat) DeepCopy() *AdditionalOutputFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(AdditionalOutputFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CAIssuer) DeepCopyInto(out *CAIssuer) {
 	*out = *in
@@ -82,22 +98,6 @@ func (in *Certificate) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertificateAdditionalOutputFormat) DeepCopyInto(out *CertificateAdditionalOutputFormat) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateAdditionalOutputFormat.
-func (in *CertificateAdditionalOutputFormat) DeepCopy() *CertificateAdditionalOutputFormat {
-	if in == nil {
-		return nil
-	}
-	out := new(CertificateAdditionalOutputFormat)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificateCondition) DeepCopyInto(out *CertificateCondition) {
 	*out = *in
@@ -469,7 +469,7 @@ func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) {
 	}
 	if in.AdditionalOutputFormats != nil {
 		in, out := &in.AdditionalOutputFormats, &out.AdditionalOutputFormats
-		*out = make([]CertificateAdditionalOutputFormat, len(*in))
+		*out = make([]AdditionalOutputFormat, len(*in))
 		copy(*out, *in)
 	}
 	return
diff --git a/internal/apis/certmanager/v1alpha3/types_certificate.go b/internal/apis/certmanager/v1alpha3/types_certificate.go
index a328db10c..6da185f6c 100644
--- a/internal/apis/certmanager/v1alpha3/types_certificate.go
+++ b/internal/apis/certmanager/v1alpha3/types_certificate.go
@@ -207,12 +207,11 @@ type CertificateSpec struct {
 	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"` // Validated by the validating webhook.
 
-	// AdditionalOutputFormats defines extra output formats of the private key
-	// and signed certificate chain to be written to this Certificate's target
-	// Secret. This is an Alpha Feature and is only enabled with the
-	// `--feature-gates=AdditionalCertificateOutputFormats=true` option.
+	// AdditionalOutputFormats allows for requests of additional output formats
+	// of the private key and the certificate to be written to the secret.
+	// This is an Alpha Feature and should be enabled with --feature-gates option.
 	// +optional
-	AdditionalOutputFormats []CertificateAdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
+	AdditionalOutputFormats []AdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
 }
 
 // CertificatePrivateKey contains configuration options for private keys
@@ -457,36 +456,26 @@ type CertificateSecretTemplate struct {
 	Labels map[string]string `json:"labels,omitempty"`
 }
 
-// CertificateOutputFormatType specifies which additional output formats should
-// be written to the Certificate's target Secret.
+// OutputFormatType specifies which additional output formats should be added to Kubernetes secrets.
 // Allowed values are `DER` or `CombinedPEM`.
-// When Type is set to `DER` an additional entry `key.der` will be written to
-// the Secret, containing the binary format of the private key.
-// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem`
-// will be written to the Secret, containing the PEM formatted private key and
-// signed certificate chain (tls.key + tls.crt concatenated).
+// When Type is set to `DER` an additional entry `key.der` will be created in the secret
+// containing the binary format of the key.
+// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem` will be created in the secret
+// containing the PEM formatted certificate chain and key (tls.key + tls.crt concatenated)
 // +kubebuilder:validation:Enum=DER;CombinedPEM
-type CertificateOutputFormatType string
+type OutputFormatType string
 
 const (
-	// CertificateOutputFormatDER  writes the Certificate's private key in DER
-	// binary format to the `key.der` target Secret Data key.
-	CertificateOutputFormatDER CertificateOutputFormatType = "DER"
-
-	// CertificateOutputFormatCombinedPEM  writes the Certificate's signed
-	// certificate chain and private key, in PEM format, to the
-	// `tls-combined.pem` target Secret Data key. The value at this key will
-	// include the private key PEM document, followed by at least one new line
-	// character, followed by the chain of signed certificate PEM documents
-	// (`<private key> + \n + <signed certificate chain>`).
-	CertificateOutputFormatCombinedPEM CertificateOutputFormatType = "CombinedPEM"
+	// AdditionalOutputFormatDER requests that the DER binary format of the key
+	// is stored in the `key.der` key of a secret
+	AdditionalOutputFormatDER OutputFormatType = "DER"
+
+	// AdditionalOutputFormatCombinedPEM requests that an entry containing both the PEM tls.crt and tls.key
+	// values concatenated is stored in the `tls-combined.pem` key of a secret
+	AdditionalOutputFormatCombinedPEM OutputFormatType = "CombinedPEM"
 )
 
-// CertificateAdditionalOutputFormat defines an additional output format of a
-// Certificate resource. These contain supplementary data formats of the signed
-// certificate chain and paired private key.
-type CertificateAdditionalOutputFormat struct {
-	// Type is the name of the format type that should be written to the
-	// Certificate's target Secret.
-	Type CertificateOutputFormatType `json:"type"`
+// AdditionalOutputFormat wraps an additional key output format type
+type AdditionalOutputFormat struct {
+	Type OutputFormatType `json:"type"`
 }
diff --git a/internal/apis/certmanager/v1alpha3/zz_generated.conversion.go b/internal/apis/certmanager/v1alpha3/zz_generated.conversion.go
index 5b781ad7e..d762ca703 100644
--- a/internal/apis/certmanager/v1alpha3/zz_generated.conversion.go
+++ b/internal/apis/certmanager/v1alpha3/zz_generated.conversion.go
@@ -42,6 +42,16 @@ func init() {
 // RegisterConversions adds conversion functions to the given scheme.
 // Public to allow building arbitrary schemes.
 func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*AdditionalOutputFormat)(nil), (*certmanager.AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1alpha3_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(a.(*AdditionalOutputFormat), b.(*certmanager.AdditionalOutputFormat), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*certmanager.AdditionalOutputFormat)(nil), (*AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_AdditionalOutputFormat_To_v1alpha3_AdditionalOutputFormat(a.(*certmanager.AdditionalOutputFormat), b.(*AdditionalOutputFormat), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddGeneratedConversionFunc((*CAIssuer)(nil), (*certmanager.CAIssuer)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1alpha3_CAIssuer_To_certmanager_CAIssuer(a.(*CAIssuer), b.(*certmanager.CAIssuer), scope)
 	}); err != nil {
@@ -62,16 +72,6 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*CertificateAdditionalOutputFormat)(nil), (*certmanager.CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha3_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(a.(*CertificateAdditionalOutputFormat), b.(*certmanager.CertificateAdditionalOutputFormat), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*certmanager.CertificateAdditionalOutputFormat)(nil), (*CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha3_CertificateAdditionalOutputFormat(a.(*certmanager.CertificateAdditionalOutputFormat), b.(*CertificateAdditionalOutputFormat), scope)
-	}); err != nil {
-		return err
-	}
 	if err := s.AddGeneratedConversionFunc((*CertificateCondition)(nil), (*certmanager.CertificateCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1alpha3_CertificateCondition_To_certmanager_CertificateCondition(a.(*CertificateCondition), b.(*certmanager.CertificateCondition), scope)
 	}); err != nil {
@@ -385,6 +385,26 @@ func RegisterConversions(s *runtime.Scheme) error {
 	return nil
 }
 
+func autoConvert_v1alpha3_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = certmanager.OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_v1alpha3_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_v1alpha3_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_v1alpha3_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in, out, s)
+}
+
+func autoConvert_certmanager_AdditionalOutputFormat_To_v1alpha3_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_certmanager_AdditionalOutputFormat_To_v1alpha3_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_certmanager_AdditionalOutputFormat_To_v1alpha3_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_certmanager_AdditionalOutputFormat_To_v1alpha3_AdditionalOutputFormat(in, out, s)
+}
+
 func autoConvert_v1alpha3_CAIssuer_To_certmanager_CAIssuer(in *CAIssuer, out *certmanager.CAIssuer, s conversion.Scope) error {
 	out.SecretName = in.SecretName
 	out.CRLDistributionPoints = *(*[]string)(unsafe.Pointer(&in.CRLDistributionPoints))
@@ -441,26 +461,6 @@ func Convert_certmanager_Certificate_To_v1alpha3_Certificate(in *certmanager.Cer
 	return autoConvert_certmanager_Certificate_To_v1alpha3_Certificate(in, out, s)
 }
 
-func autoConvert_v1alpha3_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = certmanager.CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_v1alpha3_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_v1alpha3_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_v1alpha3_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in, out, s)
-}
-
-func autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha3_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha3_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha3_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1alpha3_CertificateAdditionalOutputFormat(in, out, s)
-}
-
 func autoConvert_v1alpha3_CertificateCondition_To_certmanager_CertificateCondition(in *CertificateCondition, out *certmanager.CertificateCondition, s conversion.Scope) error {
 	out.Type = certmanager.CertificateConditionType(in.Type)
 	out.Status = meta.ConditionStatus(in.Status)
@@ -832,7 +832,7 @@ func autoConvert_v1alpha3_CertificateSpec_To_certmanager_CertificateSpec(in *Cer
 	}
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]certmanager.CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]certmanager.AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
@@ -880,7 +880,7 @@ func autoConvert_certmanager_CertificateSpec_To_v1alpha3_CertificateSpec(in *cer
 	}
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
diff --git a/internal/apis/certmanager/v1alpha3/zz_generated.deepcopy.go b/internal/apis/certmanager/v1alpha3/zz_generated.deepcopy.go
index 6b3d8ffe4..40757a98d 100644
--- a/internal/apis/certmanager/v1alpha3/zz_generated.deepcopy.go
+++ b/internal/apis/certmanager/v1alpha3/zz_generated.deepcopy.go
@@ -28,6 +28,22 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AdditionalOutputFormat) DeepCopyInto(out *AdditionalOutputFormat) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalOutputFormat.
+func (in *AdditionalOutputFormat) DeepCopy() *AdditionalOutputFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(AdditionalOutputFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CAIssuer) DeepCopyInto(out *CAIssuer) {
 	*out = *in
@@ -82,22 +98,6 @@ func (in *Certificate) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertificateAdditionalOutputFormat) DeepCopyInto(out *CertificateAdditionalOutputFormat) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateAdditionalOutputFormat.
-func (in *CertificateAdditionalOutputFormat) DeepCopy() *CertificateAdditionalOutputFormat {
-	if in == nil {
-		return nil
-	}
-	out := new(CertificateAdditionalOutputFormat)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificateCondition) DeepCopyInto(out *CertificateCondition) {
 	*out = *in
@@ -464,7 +464,7 @@ func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) {
 	}
 	if in.AdditionalOutputFormats != nil {
 		in, out := &in.AdditionalOutputFormats, &out.AdditionalOutputFormats
-		*out = make([]CertificateAdditionalOutputFormat, len(*in))
+		*out = make([]AdditionalOutputFormat, len(*in))
 		copy(*out, *in)
 	}
 	return
diff --git a/internal/apis/certmanager/v1beta1/types_certificate.go b/internal/apis/certmanager/v1beta1/types_certificate.go
index f450ac30d..19c319131 100644
--- a/internal/apis/certmanager/v1beta1/types_certificate.go
+++ b/internal/apis/certmanager/v1beta1/types_certificate.go
@@ -184,12 +184,11 @@ type CertificateSpec struct {
 	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"` // Validated by the validating webhook.
 
-	// AdditionalOutputFormats defines extra output formats of the private key
-	// and signed certificate chain to be written to this Certificate's target
-	// Secret. This is an Alpha Feature and is only enabled with the
-	// `--feature-gates=AdditionalCertificateOutputFormats=true` option.
+	// AdditionalOutputFormats allows for requests of additional output formats
+	// of the private key and the certificate to be written to the secret.
+	// This is an Alpha Feature and should be enabled with --feature-gates option.
 	// +optional
-	AdditionalOutputFormats []CertificateAdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
+	AdditionalOutputFormats []AdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
 }
 
 // CertificatePrivateKey contains configuration options for private keys
@@ -455,36 +454,26 @@ type CertificateSecretTemplate struct {
 	Labels map[string]string `json:"labels,omitempty"`
 }
 
-// CertificateOutputFormatType specifies which additional output formats should
-// be written to the Certificate's target Secret.
+// OutputFormatType specifies which additional output formats should be added to Kubernetes secrets.
 // Allowed values are `DER` or `CombinedPEM`.
-// When Type is set to `DER` an additional entry `key.der` will be written to
-// the Secret, containing the binary format of the private key.
-// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem`
-// will be written to the Secret, containing the PEM formatted private key and
-// signed certificate chain (tls.key + tls.crt concatenated).
+// When Type is set to `DER` an additional entry `key.der` will be created in the secret
+// containing the binary format of the key.
+// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem` will be created in the secret
+// containing the PEM formatted certificate chain and key (tls.key + tls.crt concatenated)
 // +kubebuilder:validation:Enum=DER;CombinedPEM
-type CertificateOutputFormatType string
+type OutputFormatType string
 
 const (
-	// CertificateOutputFormatDER  writes the Certificate's private key in DER
-	// binary format to the `key.der` target Secret Data key.
-	CertificateOutputFormatDER CertificateOutputFormatType = "DER"
-
-	// CertificateOutputFormatCombinedPEM  writes the Certificate's signed
-	// certificate chain and private key, in PEM format, to the
-	// `tls-combined.pem` target Secret Data key. The value at this key will
-	// include the private key PEM document, followed by at least one new line
-	// character, followed by the chain of signed certificate PEM documents
-	// (`<private key> + \n + <signed certificate chain>`).
-	CertificateOutputFormatCombinedPEM CertificateOutputFormatType = "CombinedPEM"
+	// AdditionalOutputFormatDER requests that the DER binary format of the key
+	// is stored in the `key.der` key of a secret
+	AdditionalOutputFormatDER OutputFormatType = "DER"
+
+	// AdditionalOutputFormatCombinedPEM requests that an entry containing both the PEM tls.crt and tls.key
+	// values concatenated is stored in the `tls-combined.pem` key of a secret
+	AdditionalOutputFormatCombinedPEM OutputFormatType = "CombinedPEM"
 )
 
-// CertificateAdditionalOutputFormat defines an additional output format of a
-// Certificate resource. These contain supplementary data formats of the signed
-// certificate chain and paired private key.
-type CertificateAdditionalOutputFormat struct {
-	// Type is the name of the format type that should be written to the
-	// Certificate's target Secret.
-	Type CertificateOutputFormatType `json:"type"`
+// AdditionalOutputFormat wraps an additional key output format type
+type AdditionalOutputFormat struct {
+	Type OutputFormatType `json:"type"`
 }
diff --git a/internal/apis/certmanager/v1beta1/zz_generated.conversion.go b/internal/apis/certmanager/v1beta1/zz_generated.conversion.go
index d41ec084c..d8f1de958 100644
--- a/internal/apis/certmanager/v1beta1/zz_generated.conversion.go
+++ b/internal/apis/certmanager/v1beta1/zz_generated.conversion.go
@@ -42,6 +42,16 @@ func init() {
 // RegisterConversions adds conversion functions to the given scheme.
 // Public to allow building arbitrary schemes.
 func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*AdditionalOutputFormat)(nil), (*certmanager.AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1beta1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(a.(*AdditionalOutputFormat), b.(*certmanager.AdditionalOutputFormat), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*certmanager.AdditionalOutputFormat)(nil), (*AdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_AdditionalOutputFormat_To_v1beta1_AdditionalOutputFormat(a.(*certmanager.AdditionalOutputFormat), b.(*AdditionalOutputFormat), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddGeneratedConversionFunc((*CAIssuer)(nil), (*certmanager.CAIssuer)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta1_CAIssuer_To_certmanager_CAIssuer(a.(*CAIssuer), b.(*certmanager.CAIssuer), scope)
 	}); err != nil {
@@ -62,16 +72,6 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*CertificateAdditionalOutputFormat)(nil), (*certmanager.CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1beta1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(a.(*CertificateAdditionalOutputFormat), b.(*certmanager.CertificateAdditionalOutputFormat), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*certmanager.CertificateAdditionalOutputFormat)(nil), (*CertificateAdditionalOutputFormat)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_certmanager_CertificateAdditionalOutputFormat_To_v1beta1_CertificateAdditionalOutputFormat(a.(*certmanager.CertificateAdditionalOutputFormat), b.(*CertificateAdditionalOutputFormat), scope)
-	}); err != nil {
-		return err
-	}
 	if err := s.AddGeneratedConversionFunc((*CertificateCondition)(nil), (*certmanager.CertificateCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta1_CertificateCondition_To_certmanager_CertificateCondition(a.(*CertificateCondition), b.(*certmanager.CertificateCondition), scope)
 	}); err != nil {
@@ -382,9 +382,34 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddConversionFunc((*certmanager.CertificatePrivateKey)(nil), (*CertificatePrivateKey)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_certmanager_CertificatePrivateKey_To_v1beta1_CertificatePrivateKey(a.(*certmanager.CertificatePrivateKey), b.(*CertificatePrivateKey), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1beta1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = certmanager.OutputFormatType(in.Type)
+	return nil
+}
+
+// Convert_v1beta1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_v1beta1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in *AdditionalOutputFormat, out *certmanager.AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_v1beta1_AdditionalOutputFormat_To_certmanager_AdditionalOutputFormat(in, out, s)
+}
+
+func autoConvert_certmanager_AdditionalOutputFormat_To_v1beta1_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *AdditionalOutputFormat, s conversion.Scope) error {
+	out.Type = OutputFormatType(in.Type)
 	return nil
 }
 
+// Convert_certmanager_AdditionalOutputFormat_To_v1beta1_AdditionalOutputFormat is an autogenerated conversion function.
+func Convert_certmanager_AdditionalOutputFormat_To_v1beta1_AdditionalOutputFormat(in *certmanager.AdditionalOutputFormat, out *AdditionalOutputFormat, s conversion.Scope) error {
+	return autoConvert_certmanager_AdditionalOutputFormat_To_v1beta1_AdditionalOutputFormat(in, out, s)
+}
+
 func autoConvert_v1beta1_CAIssuer_To_certmanager_CAIssuer(in *CAIssuer, out *certmanager.CAIssuer, s conversion.Scope) error {
 	out.SecretName = in.SecretName
 	out.CRLDistributionPoints = *(*[]string)(unsafe.Pointer(&in.CRLDistributionPoints))
@@ -441,26 +466,6 @@ func Convert_certmanager_Certificate_To_v1beta1_Certificate(in *certmanager.Cert
 	return autoConvert_certmanager_Certificate_To_v1beta1_Certificate(in, out, s)
 }
 
-func autoConvert_v1beta1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = certmanager.CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_v1beta1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_v1beta1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in *CertificateAdditionalOutputFormat, out *certmanager.CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_v1beta1_CertificateAdditionalOutputFormat_To_certmanager_CertificateAdditionalOutputFormat(in, out, s)
-}
-
-func autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1beta1_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	out.Type = CertificateOutputFormatType(in.Type)
-	return nil
-}
-
-// Convert_certmanager_CertificateAdditionalOutputFormat_To_v1beta1_CertificateAdditionalOutputFormat is an autogenerated conversion function.
-func Convert_certmanager_CertificateAdditionalOutputFormat_To_v1beta1_CertificateAdditionalOutputFormat(in *certmanager.CertificateAdditionalOutputFormat, out *CertificateAdditionalOutputFormat, s conversion.Scope) error {
-	return autoConvert_certmanager_CertificateAdditionalOutputFormat_To_v1beta1_CertificateAdditionalOutputFormat(in, out, s)
-}
-
 func autoConvert_v1beta1_CertificateCondition_To_certmanager_CertificateCondition(in *CertificateCondition, out *certmanager.CertificateCondition, s conversion.Scope) error {
 	out.Type = certmanager.CertificateConditionType(in.Type)
 	out.Status = meta.ConditionStatus(in.Status)
@@ -828,10 +833,18 @@ func autoConvert_v1beta1_CertificateSpec_To_certmanager_CertificateSpec(in *Cert
 	}
 	out.IsCA = in.IsCA
 	out.Usages = *(*[]certmanager.KeyUsage)(unsafe.Pointer(&in.Usages))
-	out.PrivateKey = (*certmanager.CertificatePrivateKey)(unsafe.Pointer(in.PrivateKey))
+	if in.PrivateKey != nil {
+		in, out := &in.PrivateKey, &out.PrivateKey
+		*out = new(certmanager.CertificatePrivateKey)
+		if err := Convert_v1beta1_CertificatePrivateKey_To_certmanager_CertificatePrivateKey(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.PrivateKey = nil
+	}
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]certmanager.CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]certmanager.AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
@@ -868,7 +881,7 @@ func autoConvert_certmanager_CertificateSpec_To_v1beta1_CertificateSpec(in *cert
 	out.PrivateKey = (*CertificatePrivateKey)(unsafe.Pointer(in.PrivateKey))
 	out.EncodeUsagesInRequest = (*bool)(unsafe.Pointer(in.EncodeUsagesInRequest))
 	out.RevisionHistoryLimit = (*int32)(unsafe.Pointer(in.RevisionHistoryLimit))
-	out.AdditionalOutputFormats = *(*[]CertificateAdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
+	out.AdditionalOutputFormats = *(*[]AdditionalOutputFormat)(unsafe.Pointer(&in.AdditionalOutputFormats))
 	return nil
 }
 
diff --git a/internal/apis/certmanager/v1beta1/zz_generated.deepcopy.go b/internal/apis/certmanager/v1beta1/zz_generated.deepcopy.go
index cf512c44c..5db1b2810 100644
--- a/internal/apis/certmanager/v1beta1/zz_generated.deepcopy.go
+++ b/internal/apis/certmanager/v1beta1/zz_generated.deepcopy.go
@@ -28,6 +28,22 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AdditionalOutputFormat) DeepCopyInto(out *AdditionalOutputFormat) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalOutputFormat.
+func (in *AdditionalOutputFormat) DeepCopy() *AdditionalOutputFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(AdditionalOutputFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CAIssuer) DeepCopyInto(out *CAIssuer) {
 	*out = *in
@@ -82,22 +98,6 @@ func (in *Certificate) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertificateAdditionalOutputFormat) DeepCopyInto(out *CertificateAdditionalOutputFormat) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateAdditionalOutputFormat.
-func (in *CertificateAdditionalOutputFormat) DeepCopy() *CertificateAdditionalOutputFormat {
-	if in == nil {
-		return nil
-	}
-	out := new(CertificateAdditionalOutputFormat)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificateCondition) DeepCopyInto(out *CertificateCondition) {
 	*out = *in
@@ -464,7 +464,7 @@ func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) {
 	}
 	if in.AdditionalOutputFormats != nil {
 		in, out := &in.AdditionalOutputFormats, &out.AdditionalOutputFormats
-		*out = make([]CertificateAdditionalOutputFormat, len(*in))
+		*out = make([]AdditionalOutputFormat, len(*in))
 		copy(*out, *in)
 	}
 	return
diff --git a/internal/apis/certmanager/zz_generated.deepcopy.go b/internal/apis/certmanager/zz_generated.deepcopy.go
index 3d8913857..520afe13e 100644
--- a/internal/apis/certmanager/zz_generated.deepcopy.go
+++ b/internal/apis/certmanager/zz_generated.deepcopy.go
@@ -28,6 +28,22 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AdditionalOutputFormat) DeepCopyInto(out *AdditionalOutputFormat) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalOutputFormat.
+func (in *AdditionalOutputFormat) DeepCopy() *AdditionalOutputFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(AdditionalOutputFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CAIssuer) DeepCopyInto(out *CAIssuer) {
 	*out = *in
@@ -82,22 +98,6 @@ func (in *Certificate) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertificateAdditionalOutputFormat) DeepCopyInto(out *CertificateAdditionalOutputFormat) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateAdditionalOutputFormat.
-func (in *CertificateAdditionalOutputFormat) DeepCopy() *CertificateAdditionalOutputFormat {
-	if in == nil {
-		return nil
-	}
-	out := new(CertificateAdditionalOutputFormat)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificateCondition) DeepCopyInto(out *CertificateCondition) {
 	*out = *in
@@ -464,7 +464,7 @@ func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) {
 	}
 	if in.AdditionalOutputFormats != nil {
 		in, out := &in.AdditionalOutputFormats, &out.AdditionalOutputFormats
-		*out = make([]CertificateAdditionalOutputFormat, len(*in))
+		*out = make([]AdditionalOutputFormat, len(*in))
 		copy(*out, *in)
 	}
 	return
diff --git a/make/tools.mk b/make/tools.mk
index 9e4afcf65..c3d2b3857 100644
--- a/make/tools.mk
+++ b/make/tools.mk
@@ -20,6 +20,8 @@ GOIMPORTS_VERSION=0.1.8
 YTT_VERSION=0.36.0
 YQ_VERSION=4.11.2
 
+KUBEBUILDER_ASSETS_VERSION=1.22.0
+
 bin/tools:
 	@mkdir -p $@
 
@@ -29,6 +31,9 @@ bin/scratch/tools:
 .PHONY: tools
 tools: bin/tools/helm bin/tools/kubectl bin/tools/kind bin/tools/cosign bin/tools/ginkgo bin/tools/cmrel bin/tools/release-notes bin/tools/goimports bin/tools/ytt bin/tools/yq
 
+.PHONY: integration-test-tools
+integration-test-tools: bin/tools/etcd bin/tools/kubectl bin/tools/kube-apiserver
+
 ########
 # Helm #
 ########
@@ -156,3 +161,37 @@ bin/tools/yq: bin/scratch/tools/yq_$(YQ_VERSION)_$(HOST_OS)_$(HOST_ARCH) | bin/t
 
 bin/scratch/tools/yq_$(YQ_VERSION)_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
 	curl -sSfL https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_$(HOST_OS)_$(HOST_ARCH) > $@
+
+############################
+# kubebuilder-tools assets #
+# kube-apiserver / etcd    #
+############################
+
+
+KUBEBUILDER_TOOLS_linux_amd64_SHA256SUM=25daf3c5d7e8b63ea933e11cd6ca157868d71a12885aba97d1e7e1a15510713e
+KUBEBUILDER_TOOLS_darwin_amd64_SHA256SUM=bb27efb1d2ee43749475293408fc80b923324ab876e5da54e58594bbe2969c42
+
+# We get our testing binaries from kubebuilder-tools, but they don't currently
+# publish darwin/arm64 binaries because of a lack of etcd / kube-apiserver support;
+# as such, we install the amd64 versions and hope that Rosetta sorts the problem
+# out for us. This means that the hash we expect is the same as the amd64 hash.
+KUBEBUILDER_TOOLS_darwin_arm64_SHA256SUM=$(KUBEBUILDER_TOOLS_darwin_amd64_SHA256SUM)
+
+bin/tools/etcd: bin/scratch/tools/kubebuilder-tools-$(KUBEBUILDER_ASSETS_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz | bin/tools
+	./hack/util/checkhash.sh $< $(KUBEBUILDER_TOOLS_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+	@# O writes the specified file to stdout
+	tar xfO $< kubebuilder/bin/etcd > $@ && chmod 775 $@
+
+bin/tools/kube-apiserver: bin/scratch/tools/kubebuilder-tools-$(KUBEBUILDER_ASSETS_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz | bin/tools
+	./hack/util/checkhash.sh $< $(KUBEBUILDER_TOOLS_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+	@# O writes the specified file to stdout
+	tar xfO $< kubebuilder/bin/kube-apiserver > $@ && chmod 775 $@
+
+bin/scratch/tools/kubebuilder-tools-$(KUBEBUILDER_ASSETS_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz: | bin/scratch/tools
+ifeq ($(HOST_OS)-$(HOST_ARCH),darwin-arm64)
+	$(eval KUBEBUILDER_ARCH := amd64)
+	$(warning Downloading amd64 kubebuilder-tools for integration tests since darwin/arm64 isn't currently packaged. This will require rosetta in order to work)
+else
+	$(eval KUBEBUILDER_ARCH := $(HOST_ARCH))
+endif
+	curl -sSfL https://storage.googleapis.com/kubebuilder-tools/kubebuilder-tools-$(KUBEBUILDER_ASSETS_VERSION)-$(HOST_OS)-$(KUBEBUILDER_ARCH).tar.gz > $@
diff --git a/pkg/apis/certmanager/v1/types_certificate.go b/pkg/apis/certmanager/v1/types_certificate.go
index 844bfd100..cbf8ba003 100644
--- a/pkg/apis/certmanager/v1/types_certificate.go
+++ b/pkg/apis/certmanager/v1/types_certificate.go
@@ -188,12 +188,11 @@ type CertificateSpec struct {
 	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"` // Validated by the validating webhook.
 
-	// AdditionalOutputFormats defines extra output formats of the private key
-	// and signed certificate chain to be written to this Certificate's target
-	// Secret. This is an Alpha Feature and is only enabled with the
-	// `--feature-gates=AdditionalCertificateOutputFormats=true` option.
+	// AdditionalOutputFormats allows for requests of additional output formats
+	// of the private key and the certificate to be written to the secret.
+	// This is an Alpha Feature and should be enabled with --feature-gates option.
 	// +optional
-	AdditionalOutputFormats []CertificateAdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
+	AdditionalOutputFormats []AdditionalOutputFormat `json:"additionalOutputFormats,omitempty"`
 }
 
 // CertificatePrivateKey contains configuration options for private keys
@@ -256,46 +255,36 @@ var (
 	RotationPolicyAlways PrivateKeyRotationPolicy = "Always"
 )
 
-// CertificateOutputFormatType specifies which additional output formats should
-// be written to the Certificate's target Secret.
+// OutputFormatType specifies which additional output formats should be added to Kubernetes secrets.
 // Allowed values are `DER` or `CombinedPEM`.
-// When Type is set to `DER` an additional entry `key.der` will be written to
-// the Secret, containing the binary format of the private key.
-// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem`
-// will be written to the Secret, containing the PEM formatted private key and
-// signed certificate chain (tls.key + tls.crt concatenated).
+// When Type is set to `DER` an additional entry `key.der` will be created in the secret
+// containing the binary format of the key.
+// When Type is set to `CombinedPEM` an additional entry `tls-combined.pem` will be created in the secret
+// containing the PEM formatted certificate chain and key (tls.key + tls.crt concatenated)
 // +kubebuilder:validation:Enum=DER;CombinedPEM
-type CertificateOutputFormatType string
+type OutputFormatType string
 
 const (
-	// CertificateOutputFormatDERKey is the name of the data entry in the Secret
-	// resource used to store the DER formatted private key.
-	CertificateOutputFormatDERKey string = "key.der"
-
-	// CertificateOutputFormatDER  writes the Certificate's private key in DER
-	// binary format to the `key.der` target Secret Data key.
-	CertificateOutputFormatDER CertificateOutputFormatType = "DER"
-
-	// CertificateOutputFormatCombinedPEMKey is the name of the data entry in the Secret
-	// resource used to store the combined PEM (key + signed certificate).
-	CertificateOutputFormatCombinedPEMKey string = "tls-combined.pem"
-
-	// CertificateOutputFormatCombinedPEM  writes the Certificate's signed
-	// certificate chain and private key, in PEM format, to the
-	// `tls-combined.pem` target Secret Data key. The value at this key will
-	// include the private key PEM document, followed by at least one new line
-	// character, followed by the chain of signed certificate PEM documents
-	// (`<private key> + \n + <signed certificate chain>`).
-	CertificateOutputFormatCombinedPEM CertificateOutputFormatType = "CombinedPEM"
+	// AdditionalOutputFormatDER requests that the DER binary format of the key
+	// is stored in the `key.der` key of the certificate's secret.
+	AdditionalOutputFormatDER OutputFormatType = "DER"
+
+	// AdditionalOutputFormatDERKey is the name of the data entry in the Secret resource
+	// used to store the DER formatted private key.
+	AdditionalOutputFormatDERKey string = "key.der"
+
+	// AdditionalOutputFormatCombinedPEM requests that an entry containing both the PEM tls.crt and tls.key
+	// values concatenated is stored in the `tls-combined.pem` key of the certificate's secret.
+	AdditionalOutputFormatCombinedPEM OutputFormatType = "CombinedPEM"
+
+	// AdditionalOutputFormatPEMKey is the name of the data entry in the Secret resource
+	// used to store the combined PEM certificate + key.
+	AdditionalOutputFormatPEMKey string = "tls-combined.pem"
 )
 
-// CertificateAdditionalOutputFormat defines an additional output format of a
-// Certificate resource. These contain supplementary data formats of the signed
-// certificate chain and paired private key.
-type CertificateAdditionalOutputFormat struct {
-	// Type is the name of the format type that should be written to the
-	// Certificate's target Secret.
-	Type CertificateOutputFormatType `json:"type"`
+// AdditionalOutputFormat wraps an additional output format type
+type AdditionalOutputFormat struct {
+	Type OutputFormatType `json:"type"`
 }
 
 // X509Subject Full X509 name specification
diff --git a/pkg/apis/certmanager/v1/zz_generated.deepcopy.go b/pkg/apis/certmanager/v1/zz_generated.deepcopy.go
index e7f86c515..2dc0428bc 100644
--- a/pkg/apis/certmanager/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/certmanager/v1/zz_generated.deepcopy.go
@@ -28,6 +28,22 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AdditionalOutputFormat) DeepCopyInto(out *AdditionalOutputFormat) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalOutputFormat.
+func (in *AdditionalOutputFormat) DeepCopy() *AdditionalOutputFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(AdditionalOutputFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CAIssuer) DeepCopyInto(out *CAIssuer) {
 	*out = *in
@@ -82,22 +98,6 @@ func (in *Certificate) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertificateAdditionalOutputFormat) DeepCopyInto(out *CertificateAdditionalOutputFormat) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateAdditionalOutputFormat.
-func (in *CertificateAdditionalOutputFormat) DeepCopy() *CertificateAdditionalOutputFormat {
-	if in == nil {
-		return nil
-	}
-	out := new(CertificateAdditionalOutputFormat)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificateCondition) DeepCopyInto(out *CertificateCondition) {
 	*out = *in
@@ -464,7 +464,7 @@ func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) {
 	}
 	if in.AdditionalOutputFormats != nil {
 		in, out := &in.AdditionalOutputFormats, &out.AdditionalOutputFormats
-		*out = make([]CertificateAdditionalOutputFormat, len(*in))
+		*out = make([]AdditionalOutputFormat, len(*in))
 		copy(*out, *in)
 	}
 	return
diff --git a/pkg/controller/certificates/internal/secretsmanager/secret.go b/pkg/controller/certificates/internal/secretsmanager/secret.go
index 3b790ebd2..11b9e5f9d 100644
--- a/pkg/controller/certificates/internal/secretsmanager/secret.go
+++ b/pkg/controller/certificates/internal/secretsmanager/secret.go
@@ -125,8 +125,8 @@ func (s *SecretsManager) UpdateData(ctx context.Context, crt *cmapi.Certificate,
 
 func updateSecretWithAdditionalOutputFormats(crt *cmapi.Certificate, secret *corev1.Secret, data SecretData) error {
 	if crt.Spec.AdditionalOutputFormats == nil {
-		delete(secret.Data, cmapi.CertificateOutputFormatDERKey)
-		delete(secret.Data, cmapi.CertificateOutputFormatCombinedPEMKey)
+		delete(secret.Data, cmapi.AdditionalOutputFormatDERKey)
+		delete(secret.Data, cmapi.AdditionalOutputFormatPEMKey)
 		return nil
 	}
 
@@ -135,9 +135,9 @@ func updateSecretWithAdditionalOutputFormats(crt *cmapi.Certificate, secret *cor
 
 	for _, f := range crt.Spec.AdditionalOutputFormats {
 		switch f.Type {
-		case cmapi.CertificateOutputFormatDER:
+		case cmapi.AdditionalOutputFormatDER:
 			additionalOutputFormatDER = true
-		case cmapi.CertificateOutputFormatCombinedPEM:
+		case cmapi.AdditionalOutputFormatCombinedPEM:
 			additionalOutputFormatPEM = true
 		default:
 			return fmt.Errorf("unknown additional output format %s", f.Type)
@@ -147,16 +147,16 @@ func updateSecretWithAdditionalOutputFormats(crt *cmapi.Certificate, secret *cor
 	if additionalOutputFormatDER {
 		// Store binary format of the private key
 		block, _ := pem.Decode(data.PrivateKey)
-		secret.Data[cmapi.CertificateOutputFormatDERKey] = block.Bytes
+		secret.Data[cmapi.AdditionalOutputFormatDERKey] = block.Bytes
 	} else {
-		delete(secret.Data, cmapi.CertificateOutputFormatDERKey)
+		delete(secret.Data, cmapi.AdditionalOutputFormatDERKey)
 	}
 
 	if additionalOutputFormatPEM {
 		// Combine tls.key and tls.crt
-		secret.Data[cmapi.CertificateOutputFormatCombinedPEMKey] = bytes.Join([][]byte{data.PrivateKey, data.Certificate}, []byte("\n"))
+		secret.Data[cmapi.AdditionalOutputFormatPEMKey] = []byte(strings.Join([]string{string(data.PrivateKey), string(data.Certificate)}, "\n"))
 	} else {
-		delete(secret.Data, cmapi.CertificateOutputFormatCombinedPEMKey)
+		delete(secret.Data, cmapi.AdditionalOutputFormatPEMKey)
 	}
 
 	return nil


Test patch:
diff --git a/pkg/controller/certificates/internal/secretsmanager/secret_test.go b/pkg/controller/certificates/internal/secretsmanager/secret_test.go
index 40e48f1b4..62ee9ae96 100644
--- a/pkg/controller/certificates/internal/secretsmanager/secret_test.go
+++ b/pkg/controller/certificates/internal/secretsmanager/secret_test.go
@@ -78,15 +78,15 @@ func TestSecretsManager(t *testing.T) {
 	// enable feature gate additional private key for this test
 	defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultMutableFeatureGate, feature.AdditionalCertificateOutputFormats, true)()
 	baseCertWithAdditionalOutputFormatDER := gen.CertificateFrom(baseCertBundle.Certificate,
-		gen.SetCertificateAdditionalOutputFormats(cmapi.CertificateAdditionalOutputFormat{Type: "DER"}),
+		gen.SetCertificateAdditionalOutputFormats(cmapi.AdditionalOutputFormat{Type: "DER"}),
 	)
 	baseCertWithAdditionalOutputFormatCombinedPEM := gen.CertificateFrom(baseCertBundle.Certificate,
-		gen.SetCertificateAdditionalOutputFormats(cmapi.CertificateAdditionalOutputFormat{Type: "CombinedPEM"}),
+		gen.SetCertificateAdditionalOutputFormats(cmapi.AdditionalOutputFormat{Type: "CombinedPEM"}),
 	)
 	baseCertWithAdditionalOutputFormats := gen.CertificateFrom(baseCertBundle.Certificate,
 		gen.SetCertificateAdditionalOutputFormats(
-			cmapi.CertificateAdditionalOutputFormat{Type: "DER"},
-			cmapi.CertificateAdditionalOutputFormat{Type: "CombinedPEM"},
+			cmapi.AdditionalOutputFormat{Type: "DER"},
+			cmapi.AdditionalOutputFormat{Type: "CombinedPEM"},
 		),
 	)
 	block, _ := pem.Decode(baseCertBundle.PrivateKeyBytes)
@@ -448,10 +448,10 @@ func TestSecretsManager(t *testing.T) {
 								Labels: map[string]string{},
 							},
 							Data: map[string][]byte{
-								corev1.TLSCertKey:                   baseCertBundle.CertBytes,
-								corev1.TLSPrivateKeyKey:             baseCertBundle.PrivateKeyBytes,
-								cmmeta.TLSCAKey:                     []byte("test-ca"),
-								cmapi.CertificateOutputFormatDERKey: tlsDerContent,
+								corev1.TLSCertKey:                  baseCertBundle.CertBytes,
+								corev1.TLSPrivateKeyKey:            baseCertBundle.PrivateKeyBytes,
+								cmmeta.TLSCAKey:                    []byte("test-ca"),
+								cmapi.AdditionalOutputFormatDERKey: tlsDerContent,
 							},
 							Type: corev1.SecretTypeTLS,
 						},
@@ -488,10 +488,10 @@ func TestSecretsManager(t *testing.T) {
 								Labels: map[string]string{},
 							},
 							Data: map[string][]byte{
-								corev1.TLSCertKey:                           baseCertBundle.CertBytes,
-								corev1.TLSPrivateKeyKey:                     baseCertBundle.PrivateKeyBytes,
-								cmmeta.TLSCAKey:                             []byte("test-ca"),
-								cmapi.CertificateOutputFormatCombinedPEMKey: []byte(strings.Join([]string{string(baseCertBundle.PrivateKeyBytes), string(baseCertBundle.CertBytes)}, "\n")),
+								corev1.TLSCertKey:                  baseCertBundle.CertBytes,
+								corev1.TLSPrivateKeyKey:            baseCertBundle.PrivateKeyBytes,
+								cmmeta.TLSCAKey:                    []byte("test-ca"),
+								cmapi.AdditionalOutputFormatPEMKey: []byte(strings.Join([]string{string(baseCertBundle.PrivateKeyBytes), string(baseCertBundle.CertBytes)}, "\n")),
 							},
 							Type: corev1.SecretTypeTLS,
 						},
@@ -528,11 +528,11 @@ func TestSecretsManager(t *testing.T) {
 								Labels: map[string]string{},
 							},
 							Data: map[string][]byte{
-								corev1.TLSCertKey:                           baseCertBundle.CertBytes,
-								corev1.TLSPrivateKeyKey:                     baseCertBundle.PrivateKeyBytes,
-								cmmeta.TLSCAKey:                             []byte("test-ca"),
-								cmapi.CertificateOutputFormatDERKey:         tlsDerContent,
-								cmapi.CertificateOutputFormatCombinedPEMKey: []byte(strings.Join([]string{string(baseCertBundle.PrivateKeyBytes), string(baseCertBundle.CertBytes)}, "\n")),
+								corev1.TLSCertKey:                  baseCertBundle.CertBytes,
+								corev1.TLSPrivateKeyKey:            baseCertBundle.PrivateKeyBytes,
+								cmmeta.TLSCAKey:                    []byte("test-ca"),
+								cmapi.AdditionalOutputFormatDERKey: tlsDerContent,
+								cmapi.AdditionalOutputFormatPEMKey: []byte(strings.Join([]string{string(baseCertBundle.PrivateKeyBytes), string(baseCertBundle.CertBytes)}, "\n")),
 							},
 							Type: corev1.SecretTypeTLS,
 						},
@@ -559,11 +559,11 @@ func TestSecretsManager(t *testing.T) {
 							},
 						},
 						Data: map[string][]byte{
-							corev1.TLSCertKey:                           []byte("foo"),
-							corev1.TLSPrivateKeyKey:                     []byte("foo"),
-							cmmeta.TLSCAKey:                             []byte("foo"),
-							cmapi.CertificateOutputFormatDERKey:         []byte("foo"),
-							cmapi.CertificateOutputFormatCombinedPEMKey: []byte("foo"),
+							corev1.TLSCertKey:                  []byte("foo"),
+							corev1.TLSPrivateKeyKey:            []byte("foo"),
+							cmmeta.TLSCAKey:                    []byte("foo"),
+							cmapi.AdditionalOutputFormatDERKey: []byte("foo"),
+							cmapi.AdditionalOutputFormatPEMKey: []byte("foo"),
 						},
 						Type: corev1.SecretTypeTLS,
 					},
@@ -621,11 +621,11 @@ func TestSecretsManager(t *testing.T) {
 							},
 						},
 						Data: map[string][]byte{
-							corev1.TLSCertKey:                           []byte("foo"),
-							corev1.TLSPrivateKeyKey:                     []byte("foo"),
-							cmmeta.TLSCAKey:                             []byte("foo"),
-							cmapi.CertificateOutputFormatDERKey:         []byte("foo"),
-							cmapi.CertificateOutputFormatCombinedPEMKey: []byte("foo"),
+							corev1.TLSCertKey:                  []byte("foo"),
+							corev1.TLSPrivateKeyKey:            []byte("foo"),
+							cmmeta.TLSCAKey:                    []byte("foo"),
+							cmapi.AdditionalOutputFormatDERKey: []byte("foo"),
+							cmapi.AdditionalOutputFormatPEMKey: []byte("foo"),
 						},
 						Type: corev1.SecretTypeTLS,
 					},
@@ -654,10 +654,10 @@ func TestSecretsManager(t *testing.T) {
 								Labels: map[string]string{},
 							},
 							Data: map[string][]byte{
-								corev1.TLSCertKey:                   baseCertBundle.CertBytes,
-								corev1.TLSPrivateKeyKey:             baseCertBundle.PrivateKeyBytes,
-								cmmeta.TLSCAKey:                     []byte("test-ca"),
-								cmapi.CertificateOutputFormatDERKey: tlsDerContent,
+								corev1.TLSCertKey:                  baseCertBundle.CertBytes,
+								corev1.TLSPrivateKeyKey:            baseCertBundle.PrivateKeyBytes,
+								cmmeta.TLSCAKey:                    []byte("test-ca"),
+								cmapi.AdditionalOutputFormatDERKey: tlsDerContent,
 							},
 							Type: corev1.SecretTypeTLS,
 						},
@@ -684,11 +684,11 @@ func TestSecretsManager(t *testing.T) {
 							},
 						},
 						Data: map[string][]byte{
-							corev1.TLSCertKey:                           []byte("foo"),
-							corev1.TLSPrivateKeyKey:                     []byte("foo"),
-							cmmeta.TLSCAKey:                             []byte("foo"),
-							cmapi.CertificateOutputFormatDERKey:         []byte("foo"),
-							cmapi.CertificateOutputFormatCombinedPEMKey: []byte("foo"),
+							corev1.TLSCertKey:                  []byte("foo"),
+							corev1.TLSPrivateKeyKey:            []byte("foo"),
+							cmmeta.TLSCAKey:                    []byte("foo"),
+							cmapi.AdditionalOutputFormatDERKey: []byte("foo"),
+							cmapi.AdditionalOutputFormatPEMKey: []byte("foo"),
 						},
 						Type: corev1.SecretTypeTLS,
 					},
@@ -717,10 +717,10 @@ func TestSecretsManager(t *testing.T) {
 								Labels: map[string]string{},
 							},
 							Data: map[string][]byte{
-								corev1.TLSCertKey:                           baseCertBundle.CertBytes,
-								corev1.TLSPrivateKeyKey:                     baseCertBundle.PrivateKeyBytes,
-								cmmeta.TLSCAKey:                             []byte("test-ca"),
-								cmapi.CertificateOutputFormatCombinedPEMKey: []byte(strings.Join([]string{string(baseCertBundle.PrivateKeyBytes), string(baseCertBundle.CertBytes)}, "\n")),
+								corev1.TLSCertKey:                  baseCertBundle.CertBytes,
+								corev1.TLSPrivateKeyKey:            baseCertBundle.PrivateKeyBytes,
+								cmmeta.TLSCAKey:                    []byte("test-ca"),
+								cmapi.AdditionalOutputFormatPEMKey: []byte(strings.Join([]string{string(baseCertBundle.PrivateKeyBytes), string(baseCertBundle.CertBytes)}, "\n")),
 							},
 							Type: corev1.SecretTypeTLS,
 						},
diff --git a/test/e2e/framework/helper/validation/certificates/certificates.go b/test/e2e/framework/helper/validation/certificates/certificates.go
index fff7f7761..3d4bae056 100644
--- a/test/e2e/framework/helper/validation/certificates/certificates.go
+++ b/test/e2e/framework/helper/validation/certificates/certificates.go
@@ -41,7 +41,7 @@ type ValidationFunc func(certificate *cmapi.Certificate, secret *corev1.Secret)
 
 // ExpectValidKeysInSecret checks that the secret contains valid keys
 func ExpectValidKeysInSecret(_ *cmapi.Certificate, secret *corev1.Secret) error {
-	validKeys := [5]string{corev1.TLSPrivateKeyKey, corev1.TLSCertKey, cmmeta.TLSCAKey, cmapi.CertificateOutputFormatDERKey, cmapi.CertificateOutputFormatCombinedPEMKey}
+	validKeys := [5]string{corev1.TLSPrivateKeyKey, corev1.TLSCertKey, cmmeta.TLSCAKey, cmapi.AdditionalOutputFormatDERKey, cmapi.AdditionalOutputFormatPEMKey}
 	nbValidKeys := 0
 	for k := range secret.Data {
 		for _, k2 := range validKeys {
@@ -382,26 +382,26 @@ func ExpectValidAdditionalOutputFormats(certificate *cmapi.Certificate, secret *
 	if len(certificate.Spec.AdditionalOutputFormats) > 0 {
 		for _, f := range certificate.Spec.AdditionalOutputFormats {
 			switch f.Type {
-			case cmapi.CertificateOutputFormatDER:
-				if derKey, ok := secret.Data[cmapi.CertificateOutputFormatDERKey]; ok {
+			case cmapi.AdditionalOutputFormatDER:
+				if derKey, ok := secret.Data[cmapi.AdditionalOutputFormatDERKey]; ok {
 					privateKey := secret.Data[corev1.TLSPrivateKeyKey]
 					block, _ := pem.Decode(privateKey)
 					if !bytes.Equal(derKey, block.Bytes) {
-						return fmt.Errorf("expected additional output Format DER %s to contain the binary formated private Key", cmapi.CertificateOutputFormatDERKey)
+						return fmt.Errorf("expected additional output Format DER %s to contain the binary formated private Key", cmapi.AdditionalOutputFormatDERKey)
 					}
 				} else {
-					return fmt.Errorf("expected additional output format DER key %s to be present in secret", cmapi.CertificateOutputFormatDERKey)
+					return fmt.Errorf("expected additional output format DER key %s to be present in secret", cmapi.AdditionalOutputFormatDERKey)
 				}
-			case cmapi.CertificateOutputFormatCombinedPEM:
-				if combinedPem, ok := secret.Data[cmapi.CertificateOutputFormatCombinedPEMKey]; ok {
+			case cmapi.AdditionalOutputFormatCombinedPEM:
+				if combinedPem, ok := secret.Data[cmapi.AdditionalOutputFormatPEMKey]; ok {
 					privateKey := secret.Data[corev1.TLSPrivateKeyKey]
 					certificate := secret.Data[corev1.TLSCertKey]
 					expectedCombinedPem := []byte(strings.Join([]string{string(privateKey), string(certificate)}, "\n"))
 					if !bytes.Equal(combinedPem, expectedCombinedPem) {
-						return fmt.Errorf("expected additional output format CombinedPEM %s to contain the combination of privateKey and certificate", cmapi.CertificateOutputFormatCombinedPEMKey)
+						return fmt.Errorf("expected additional output format CombinedPEM %s to contain the combination of privateKey and certificate", cmapi.AdditionalOutputFormatPEMKey)
 					}
 				} else {
-					return fmt.Errorf("expected additional output format CombinedPEM key %s to be present in secret", cmapi.CertificateOutputFormatCombinedPEMKey)
+					return fmt.Errorf("expected additional output format CombinedPEM key %s to be present in secret", cmapi.AdditionalOutputFormatPEMKey)
 				}
 
 			default:
diff --git a/test/e2e/suite/issuers/ca/certificate.go b/test/e2e/suite/issuers/ca/certificate.go
index 258dbce5e..c47d3defe 100644
--- a/test/e2e/suite/issuers/ca/certificate.go
+++ b/test/e2e/suite/issuers/ca/certificate.go
@@ -129,7 +129,7 @@ var _ = framework.CertManagerDescribe("CA Certificate", func() {
 			certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
 
 			cert := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
-			cert.Spec.AdditionalOutputFormats = []v1.CertificateAdditionalOutputFormat{
+			cert.Spec.AdditionalOutputFormats = []v1.AdditionalOutputFormat{
 				{Type: "DER"},
 				{Type: "CombinedPEM"},
 			}
diff --git a/test/unit/gen/certificate.go b/test/unit/gen/certificate.go
index 8b997daf8..d42a8822f 100644
--- a/test/unit/gen/certificate.go
+++ b/test/unit/gen/certificate.go
@@ -262,7 +262,7 @@ func SetCertificateRevisionHistoryLimit(limit int32) CertificateModifier {
 	}
 }
 
-func SetCertificateAdditionalOutputFormats(additionalOutputFormats ...v1.CertificateAdditionalOutputFormat) CertificateModifier {
+func SetCertificateAdditionalOutputFormats(additionalOutputFormats ...v1.AdditionalOutputFormat) CertificateModifier {
 	return func(crt *v1.Certificate) {
 		crt.Spec.AdditionalOutputFormats = additionalOutputFormats
 	}