cert-manager stores certs as tls.crt/tls.key but MinIO expects public.crt/private.key — add volume items projection. mc client doesn't use MC_CA_CERTIFICATE env; instead copy CA cert to ~/.mc/certs/CAs/ before running mc alias set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>