diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 477d6299ae7..6dd12cbda66 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -49,6 +49,30 @@ aliases:
     - thockin
     - wojtek-t
 
+  sig-auth-certificates-approvers:
+    - liggitt
+    - mikedanese
+    - smarterclayton
+  sig-auth-certificates-reviewers:
+    - awly
+    - caesarxuchao
+    - david-mcmahon
+    - deads2k
+    - dims
+    - enj
+    - errordeveloper
+    - hongchaodeng
+    - jianhuiz
+    - lavalamp
+    - liggitt
+    - mbohlool
+    - mikedanese
+    - smarterclayton
+    - sttts
+    - thockin
+    - timothysc
+    - wojtek-t
+
   sig-storage-reviewers:
     - saad-ali
     - childsb
diff --git a/pkg/apis/certificates/OWNERS b/pkg/apis/certificates/OWNERS
index 1d1ab36e756..796d862bd9c 100755
--- a/pkg/apis/certificates/OWNERS
+++ b/pkg/apis/certificates/OWNERS
@@ -1,14 +1,7 @@
+# approval on api packages bubbles to api-approvers
 reviewers:
-- thockin
-- lavalamp
-- smarterclayton
-- deads2k
-- caesarxuchao
-- liggitt
-- sttts
-- dims
-- errordeveloper
-- mbohlool
-- david-mcmahon
-- jianhuiz
-- enj
+- sig-auth-certificates-approvers
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+
diff --git a/pkg/controller/certificates/OWNERS b/pkg/controller/certificates/OWNERS
index e77a57187c9..470b7a1c92d 100755
--- a/pkg/controller/certificates/OWNERS
+++ b/pkg/controller/certificates/OWNERS
@@ -1,4 +1,7 @@
+approvers:
+- sig-auth-certificates-approvers
 reviewers:
-- deads2k
-- mikedanese
-- awly
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+
diff --git a/pkg/kubelet/certificate/OWNERS b/pkg/kubelet/certificate/OWNERS
index dcb32d2b8c8..470b7a1c92d 100644
--- a/pkg/kubelet/certificate/OWNERS
+++ b/pkg/kubelet/certificate/OWNERS
@@ -1,7 +1,7 @@
-reviewers:
-- mikedanese
-- liggitt
-- awly
 approvers:
-- mikedanese
-- liggitt
+- sig-auth-certificates-approvers
+reviewers:
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+
diff --git a/pkg/registry/certificates/OWNERS b/pkg/registry/certificates/OWNERS
index ce89a734755..470b7a1c92d 100755
--- a/pkg/registry/certificates/OWNERS
+++ b/pkg/registry/certificates/OWNERS
@@ -1,11 +1,7 @@
+approvers:
+- sig-auth-certificates-approvers
 reviewers:
-- smarterclayton
-- wojtek-t
-- deads2k
-- mikedanese
-- liggitt
-- timothysc
-- dims
-- hongchaodeng
-- david-mcmahon
-- enj
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+
diff --git a/staging/src/k8s.io/apiserver/pkg/authentication/request/x509/OWNERS b/staging/src/k8s.io/apiserver/pkg/authentication/request/x509/OWNERS
new file mode 100644
index 00000000000..470b7a1c92d
--- /dev/null
+++ b/staging/src/k8s.io/apiserver/pkg/authentication/request/x509/OWNERS
@@ -0,0 +1,7 @@
+approvers:
+- sig-auth-certificates-approvers
+reviewers:
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+
diff --git a/staging/src/k8s.io/client-go/util/cert/OWNERS b/staging/src/k8s.io/client-go/util/cert/OWNERS
new file mode 100644
index 00000000000..470b7a1c92d
--- /dev/null
+++ b/staging/src/k8s.io/client-go/util/cert/OWNERS
@@ -0,0 +1,7 @@
+approvers:
+- sig-auth-certificates-approvers
+reviewers:
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+
diff --git a/staging/src/k8s.io/client-go/util/certificate/OWNERS b/staging/src/k8s.io/client-go/util/certificate/OWNERS
index 2dce803b34d..470b7a1c92d 100644
--- a/staging/src/k8s.io/client-go/util/certificate/OWNERS
+++ b/staging/src/k8s.io/client-go/util/certificate/OWNERS
@@ -1,8 +1,7 @@
-reviewers:
-- mikedanese
-- liggit
-- smarterclayton
 approvers:
-- mikedanese
-- liggit
-- smarterclayton
+- sig-auth-certificates-approvers
+reviewers:
+- sig-auth-certificates-reviewers
+labels:
+- sig/auth
+