diff --git a/charts/enterprise/clusterissuer/Chart.yaml b/charts/enterprise/clusterissuer/Chart.yaml
index 05043c28edd..e04da90491f 100644
--- a/charts/enterprise/clusterissuer/Chart.yaml
+++ b/charts/enterprise/clusterissuer/Chart.yaml
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/clusterissuer
   - https://cert-manager.io/
 type: application
-version: 4.0.1
+version: 4.0.2
 annotations:
   truecharts.org/catagories: |
     - core
diff --git a/charts/enterprise/clusterissuer/templates/clusterissuer/_ACME.tpl b/charts/enterprise/clusterissuer/templates/clusterissuer/_ACME.tpl
index 1d5c4865c16..0922452e79e 100644
--- a/charts/enterprise/clusterissuer/templates/clusterissuer/_ACME.tpl
+++ b/charts/enterprise/clusterissuer/templates/clusterissuer/_ACME.tpl
@@ -1,6 +1,15 @@
 {{- define "certmanager.clusterissuer.acme" -}}
 {{- $operator := index $.Values.operator "cert-manager" -}}
 {{- $namespace := $operator.namespace | default "cert-manager" -}}
+
+{{- $rfctsigSecret := .rfctsigSecret | default "" -}}
+{{/* https://cert-manager.io/docs/configuration/acme/dns01/rfc2136/#troubleshooting */}}
+{{- if $rfctsigSecret -}} {{/* If we try to decode and fail, go on and encode it. */}}
+  {{- if (contains "illegal base64" (b64dec $rfctsigSecret)) -}}
+    {{- $rfctsigSecret = b64enc $rfctsigSecret -}}
+  {{- end -}}
+{{- end -}}
+
 {{- range .Values.clusterIssuer.ACME }}
   {{- if not (mustRegexMatch "^[a-z]+(-?[a-z]){0,63}-?[a-z]+$" .name) -}}
     {{- fail "ACME - Expected name to be all lowercase with hyphens, but not start or end with a hyphen" -}}
@@ -93,6 +102,6 @@ stringData:
   akclientSecret: {{ .akclientSecret | default "" }}
   akaccessToken: {{ .akaccessToken | default "" }}
   doaccessToken: {{ .doaccessToken | default "" }}
-  rfctsigSecret: {{ .rfctsigSecret | default "" }}
+  rfctsigSecret: {{ $rfctsigSecret }}
 {{- end }}
 {{- end -}}