diff --git a/cmd/webhook/app/BUILD.bazel b/cmd/webhook/app/BUILD.bazel
index 1be144d04..d031fdbc8 100644
--- a/cmd/webhook/app/BUILD.bazel
+++ b/cmd/webhook/app/BUILD.bazel
@@ -8,7 +8,7 @@ go_library(
     deps = [
         "//cmd/util:go_default_library",
         "//cmd/webhook/app/options:go_default_library",
-        "//internal/apis/config:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
         "//pkg/logs:go_default_library",
         "//pkg/util:go_default_library",
         "//pkg/webhook:go_default_library",
diff --git a/cmd/webhook/app/options/BUILD.bazel b/cmd/webhook/app/options/BUILD.bazel
index 34b828dd3..10f13e741 100644
--- a/cmd/webhook/app/options/BUILD.bazel
+++ b/cmd/webhook/app/options/BUILD.bazel
@@ -9,9 +9,9 @@ go_library(
     importpath = "github.com/jetstack/cert-manager/cmd/webhook/app/options",
     visibility = ["//visibility:public"],
     deps = [
-        "//internal/apis/config:go_default_library",
-        "//internal/apis/config/scheme:go_default_library",
-        "//pkg/apis/config/v1alpha1:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
+        "//internal/apis/config/webhook/scheme:go_default_library",
+        "//pkg/apis/config/webhook/v1alpha1:go_default_library",
         "//pkg/logs:go_default_library",
         "@com_github_spf13_pflag//:go_default_library",
         "@io_k8s_component_base//cli/flag:go_default_library",
diff --git a/cmd/webhook/app/options/options.go b/cmd/webhook/app/options/options.go
index b2adccd55..a683009c2 100644
--- a/cmd/webhook/app/options/options.go
+++ b/cmd/webhook/app/options/options.go
@@ -22,9 +22,9 @@ import (
 	"github.com/spf13/pflag"
 	cliflag "k8s.io/component-base/cli/flag"
 
-	"github.com/jetstack/cert-manager/internal/apis/config"
-	configscheme "github.com/jetstack/cert-manager/internal/apis/config/scheme"
-	configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1"
+	config "github.com/jetstack/cert-manager/internal/apis/config/webhook"
+	configscheme "github.com/jetstack/cert-manager/internal/apis/config/webhook/scheme"
+	configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1"
 )
 
 // WebhookFlags defines options that can only be configured via flags.
diff --git a/cmd/webhook/app/webhook.go b/cmd/webhook/app/webhook.go
index 57dfb5b04..696c32f5a 100644
--- a/cmd/webhook/app/webhook.go
+++ b/cmd/webhook/app/webhook.go
@@ -31,7 +31,7 @@ import (
 
 	cmdutil "github.com/jetstack/cert-manager/cmd/util"
 	"github.com/jetstack/cert-manager/cmd/webhook/app/options"
-	"github.com/jetstack/cert-manager/internal/apis/config"
+	config "github.com/jetstack/cert-manager/internal/apis/config/webhook"
 	logf "github.com/jetstack/cert-manager/pkg/logs"
 	"github.com/jetstack/cert-manager/pkg/util"
 	"github.com/jetstack/cert-manager/pkg/webhook"
diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml
index 336e80f62..6a4007153 100644
--- a/deploy/charts/cert-manager/values.yaml
+++ b/deploy/charts/cert-manager/values.yaml
@@ -211,7 +211,7 @@ webhook:
   # An APIVersion and Kind must be specified in your values.yaml file.
   # Flags will override options that are set here.
   config:
-    # apiVersion: config.cert-manager.io/v1alpha1
+    # apiVersion: config.webhook.cert-manager.io/v1alpha1
     # kind: WebhookConfiguration
 
   strategy: {}
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 1bfdfe541..491f32842 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -44,8 +44,8 @@ deepcopy_inputs=(
   pkg/apis/acme/v1beta1 \
   pkg/apis/acme/v1 \
   internal/apis/acme \
-  pkg/apis/config/v1alpha1 \
-  internal/apis/config \
+  pkg/apis/config/webhook/v1alpha1 \
+  internal/apis/config/webhook \
   pkg/apis/meta/v1 \
   internal/apis/meta \
   pkg/webhook/handlers/testdata/apis/testgroup/v2 \
@@ -78,7 +78,7 @@ defaulter_inputs=(
   internal/apis/acme/v1alpha3 \
   internal/apis/acme/v1beta1 \
   internal/apis/acme/v1 \
-  internal/apis/config/v1alpha1 \
+  internal/apis/config/webhook/v1alpha1 \
   internal/apis/meta/v1 \
   pkg/webhook/handlers/testdata/apis/testgroup/v2 \
   pkg/webhook/handlers/testdata/apis/testgroup/v1 \
@@ -94,7 +94,7 @@ conversion_inputs=(
   internal/apis/acme/v1alpha3 \
   internal/apis/acme/v1beta1 \
   internal/apis/acme/v1 \
-  internal/apis/config/v1alpha1 \
+  internal/apis/config/webhook/v1alpha1 \
   internal/apis/meta/v1 \
   pkg/webhook/handlers/testdata/apis/testgroup/v2 \
   pkg/webhook/handlers/testdata/apis/testgroup/v1 \
diff --git a/internal/BUILD.bazel b/internal/BUILD.bazel
index be7f45a01..158de8e87 100644
--- a/internal/BUILD.bazel
+++ b/internal/BUILD.bazel
@@ -13,7 +13,7 @@ filegroup(
         "//internal/api/validation:all-srcs",
         "//internal/apis/acme:all-srcs",
         "//internal/apis/certmanager:all-srcs",
-        "//internal/apis/config:all-srcs",
+        "//internal/apis/config/webhook:all-srcs",
         "//internal/apis/meta:all-srcs",
         "//internal/ingress:all-srcs",
         "//internal/vault:all-srcs",
diff --git a/internal/apis/config/webhook/BUILD.bazel b/internal/apis/config/webhook/BUILD.bazel
index 0059bb914..c243de4b7 100644
--- a/internal/apis/config/webhook/BUILD.bazel
+++ b/internal/apis/config/webhook/BUILD.bazel
@@ -5,13 +5,13 @@ go_library(
     srcs = [
         "doc.go",
         "register.go",
-        "types_webhook.go",
+        "types.go",
         "zz_generated.deepcopy.go",
     ],
-    importpath = "github.com/jetstack/cert-manager/internal/apis/config",
+    importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//pkg/apis/config:go_default_library",
+        "//pkg/apis/config/webhook:go_default_library",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
@@ -29,11 +29,11 @@ filegroup(
     name = "all-srcs",
     srcs = [
         ":package-srcs",
-        "//internal/apis/config/fuzzer:all-srcs",
-        "//internal/apis/config/install:all-srcs",
-        "//internal/apis/config/scheme:all-srcs",
-        "//internal/apis/config/v1alpha1:all-srcs",
-        "//internal/apis/config/validation:all-srcs",
+        "//internal/apis/config/webhook/fuzzer:all-srcs",
+        "//internal/apis/config/webhook/install:all-srcs",
+        "//internal/apis/config/webhook/scheme:all-srcs",
+        "//internal/apis/config/webhook/v1alpha1:all-srcs",
+        "//internal/apis/config/webhook/validation:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],
diff --git a/internal/apis/config/webhook/doc.go b/internal/apis/config/webhook/doc.go
index dba76ef4c..6026527b7 100644
--- a/internal/apis/config/webhook/doc.go
+++ b/internal/apis/config/webhook/doc.go
@@ -16,6 +16,6 @@ limitations under the License.
 
 // +k8s:deepcopy-gen=package,register
 
-// Package config is the internal version of the API.
-// +groupName=config.cert-manager.io
-package config
+// Package webhook is the internal version of the webhook config API.
+// +groupName=webhook.config.cert-manager.io
+package webhook
diff --git a/internal/apis/config/webhook/fuzzer/BUILD.bazel b/internal/apis/config/webhook/fuzzer/BUILD.bazel
index 5445eab14..e20e9353d 100644
--- a/internal/apis/config/webhook/fuzzer/BUILD.bazel
+++ b/internal/apis/config/webhook/fuzzer/BUILD.bazel
@@ -3,10 +3,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = ["fuzzer.go"],
-    importpath = "github.com/jetstack/cert-manager/internal/apis/config/fuzzer",
+    importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/fuzzer",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//internal/apis/config:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
         "@com_github_google_gofuzz//:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library",
         "@io_k8s_utils//pointer:go_default_library",
diff --git a/internal/apis/config/webhook/fuzzer/fuzzer.go b/internal/apis/config/webhook/fuzzer/fuzzer.go
index ce0307a8a..879e4eb6a 100644
--- a/internal/apis/config/webhook/fuzzer/fuzzer.go
+++ b/internal/apis/config/webhook/fuzzer/fuzzer.go
@@ -21,13 +21,13 @@ import (
 	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/utils/pointer"
 
-	"github.com/jetstack/cert-manager/internal/apis/config"
+	"github.com/jetstack/cert-manager/internal/apis/config/webhook"
 )
 
-// Funcs returns the fuzzer functions for the apps api group.
+// Funcs returns the fuzzer functions for the webhook config api group.
 var Funcs = func(codecs runtimeserializer.CodecFactory) []interface{} {
 	return []interface{}{
-		func(s *config.WebhookConfiguration, c fuzz.Continue) {
+		func(s *webhook.WebhookConfiguration, c fuzz.Continue) {
 			c.FuzzNoCustom(s) // fuzz self without calling this function again
 
 			if s.HealthzPort == nil {
diff --git a/internal/apis/config/webhook/install/BUILD.bazel b/internal/apis/config/webhook/install/BUILD.bazel
index 5cc101baf..513f9a130 100644
--- a/internal/apis/config/webhook/install/BUILD.bazel
+++ b/internal/apis/config/webhook/install/BUILD.bazel
@@ -3,11 +3,11 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 go_library(
     name = "go_default_library",
     srcs = ["install.go"],
-    importpath = "github.com/jetstack/cert-manager/internal/apis/config/install",
+    importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/install",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//internal/apis/config:go_default_library",
-        "//internal/apis/config/v1alpha1:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
+        "//internal/apis/config/webhook/v1alpha1:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/util/runtime:go_default_library",
     ],
@@ -35,7 +35,7 @@ go_test(
     ],
     embed = [":go_default_library"],
     deps = [
-        "//internal/apis/config/fuzzer:go_default_library",
+        "//internal/apis/config/webhook/fuzzer:go_default_library",
         "@io_k8s_apimachinery//pkg/api/apitesting/roundtrip:go_default_library",
     ],
 )
diff --git a/internal/apis/config/webhook/install/install.go b/internal/apis/config/webhook/install/install.go
index 3c0a3bc3c..426dcc8f7 100644
--- a/internal/apis/config/webhook/install/install.go
+++ b/internal/apis/config/webhook/install/install.go
@@ -22,12 +22,12 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 
-	"github.com/jetstack/cert-manager/internal/apis/config"
-	"github.com/jetstack/cert-manager/internal/apis/config/v1alpha1"
+	"github.com/jetstack/cert-manager/internal/apis/config/webhook"
+	"github.com/jetstack/cert-manager/internal/apis/config/webhook/v1alpha1"
 )
 
 // Install registers the API group and adds types to a scheme
 func Install(scheme *runtime.Scheme) {
-	utilruntime.Must(config.AddToScheme(scheme))
+	utilruntime.Must(webhook.AddToScheme(scheme))
 	utilruntime.Must(v1alpha1.AddToScheme(scheme))
 }
diff --git a/internal/apis/config/webhook/install/roundtrip_test.go b/internal/apis/config/webhook/install/roundtrip_test.go
index ce7cd163b..6175d8b9f 100644
--- a/internal/apis/config/webhook/install/roundtrip_test.go
+++ b/internal/apis/config/webhook/install/roundtrip_test.go
@@ -21,7 +21,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/api/apitesting/roundtrip"
 
-	configfuzzer "github.com/jetstack/cert-manager/internal/apis/config/fuzzer"
+	configfuzzer "github.com/jetstack/cert-manager/internal/apis/config/webhook/fuzzer"
 )
 
 func TestRoundTripTypes(t *testing.T) {
diff --git a/internal/apis/config/webhook/register.go b/internal/apis/config/webhook/register.go
index f9352266e..0fa94f50e 100644
--- a/internal/apis/config/webhook/register.go
+++ b/internal/apis/config/webhook/register.go
@@ -14,12 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package config
+package webhook
 
 import (
-	"github.com/jetstack/cert-manager/pkg/apis/config/webhook"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/jetstack/cert-manager/pkg/apis/config/webhook"
 )
 
 var (
diff --git a/internal/apis/config/webhook/scheme/BUILD.bazel b/internal/apis/config/webhook/scheme/BUILD.bazel
index d2b3fdd30..bb3921a3f 100644
--- a/internal/apis/config/webhook/scheme/BUILD.bazel
+++ b/internal/apis/config/webhook/scheme/BUILD.bazel
@@ -3,11 +3,11 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = ["scheme.go"],
-    importpath = "github.com/jetstack/cert-manager/internal/apis/config/scheme",
+    importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/scheme",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//internal/apis/config:go_default_library",
-        "//internal/apis/config/v1alpha1:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
+        "//internal/apis/config/webhook/v1alpha1:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library",
     ],
diff --git a/internal/apis/config/webhook/scheme/scheme.go b/internal/apis/config/webhook/scheme/scheme.go
index 3f301134a..e5b607768 100644
--- a/internal/apis/config/webhook/scheme/scheme.go
+++ b/internal/apis/config/webhook/scheme/scheme.go
@@ -20,8 +20,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 
-	"github.com/jetstack/cert-manager/internal/apis/config"
-	configv1alpha1 "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1"
+	config "github.com/jetstack/cert-manager/internal/apis/config/webhook"
+	configv1alpha1 "github.com/jetstack/cert-manager/internal/apis/config/webhook/v1alpha1"
 )
 
 // NewSchemeAndCodecs is a utility function that returns a Scheme and CodecFactory
diff --git a/internal/apis/config/webhook/types.go b/internal/apis/config/webhook/types.go
index 2d9939ddf..4eac795fb 100644
--- a/internal/apis/config/webhook/types.go
+++ b/internal/apis/config/webhook/types.go
@@ -32,7 +32,7 @@ type WebhookConfiguration struct {
 	HealthzPort *int
 
 	// tlsConfig is used to configure the secure listener's TLS settings.
-	TLSConfig WebhookTLSConfig
+	TLSConfig TLSConfig
 
 	// kubeConfig is the kubeconfig file used to connect to the Kubernetes apiserver.
 	// If not specified, the webhook will attempt to load the in-cluster-config.
@@ -50,9 +50,9 @@ type WebhookConfiguration struct {
 	PprofAddress string
 }
 
-// WebhookTLSConfig configures how TLS certificates are sourced for serving.
+// TLSConfig configures how TLS certificates are sourced for serving.
 // Only one of 'filesystem' or 'dynamic' may be specified.
-type WebhookTLSConfig struct {
+type TLSConfig struct {
 	// cipherSuites is the list of allowed cipher suites for the server.
 	// Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants).
 	// If not specified, the default for the Go version will be used and may change over time.
@@ -65,7 +65,7 @@ type WebhookTLSConfig struct {
 
 	// Filesystem enables using a certificate and private key found on the local filesystem.
 	// These files will be periodically polled in case they have changed, and dynamically reloaded.
-	Filesystem WebhookFilesystemServingConfig
+	Filesystem FilesystemServingConfig
 
 	// When Dynamic serving is enabled, the webhook will generate a CA used to sign webhook
 	// certificates and persist it into a Kubernetes Secret resource (for other replicas of the
@@ -73,26 +73,26 @@ type WebhookTLSConfig struct {
 	// It will then generate a certificate in-memory for itself using this CA to serve with.
 	// The CAs certificate can then be copied into the appropriate Validating, Mutating and Conversion
 	// webhook configuration objects (typically by cainjector).
-	Dynamic WebhookDynamicServingConfig
+	Dynamic DynamicServingConfig
 }
 
-func (c *WebhookTLSConfig) FilesystemConfigProvided() bool {
+func (c *TLSConfig) FilesystemConfigProvided() bool {
 	if c.Filesystem.KeyFile != "" || c.Filesystem.CertFile != "" {
 		return true
 	}
 	return false
 }
 
-func (c *WebhookTLSConfig) DynamicConfigProvided() bool {
+func (c *TLSConfig) DynamicConfigProvided() bool {
 	if c.Dynamic.SecretNamespace != "" || c.Dynamic.SecretName != "" || len(c.Dynamic.DNSNames) > 0 {
 		return true
 	}
 	return false
 }
 
-// WebhookDynamicServingConfig makes the webhook generate a CA and persist it into Secret resources.
+// DynamicServingConfig makes the webhook generate a CA and persist it into Secret resources.
 // This CA will be used by all instances of the webhook for signing serving certificates.
-type WebhookDynamicServingConfig struct {
+type DynamicServingConfig struct {
 	// Namespace of the Kubernetes Secret resource containing the TLS certificate
 	// used as a CA to sign dynamic serving certificates.
 	SecretNamespace string
@@ -105,9 +105,9 @@ type WebhookDynamicServingConfig struct {
 	DNSNames []string
 }
 
-// WebhookFilesystemServingConfig enables using a certificate and private key found on the local filesystem.
+// FilesystemServingConfig enables using a certificate and private key found on the local filesystem.
 // These files will be periodically polled in case they have changed, and dynamically reloaded.
-type WebhookFilesystemServingConfig struct {
+type FilesystemServingConfig struct {
 	// Path to a file containing TLS certificate & chain to serve with
 	CertFile string
 
diff --git a/internal/apis/config/webhook/v1alpha1/BUILD.bazel b/internal/apis/config/webhook/v1alpha1/BUILD.bazel
index 486f4e54d..b9e93ab06 100644
--- a/internal/apis/config/webhook/v1alpha1/BUILD.bazel
+++ b/internal/apis/config/webhook/v1alpha1/BUILD.bazel
@@ -10,12 +10,12 @@ go_library(
         "zz_generated.conversion.go",
         "zz_generated.defaults.go",
     ],
-    importpath = "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1",
+    importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/v1alpha1",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//internal/apis/config:go_default_library",
-        "//pkg/apis/config:go_default_library",
-        "//pkg/apis/config/v1alpha1:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
+        "//pkg/apis/config/webhook:go_default_library",
+        "//pkg/apis/config/webhook/v1alpha1:go_default_library",
         "@io_k8s_apimachinery//pkg/conversion:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
diff --git a/internal/apis/config/webhook/v1alpha1/defaults.go b/internal/apis/config/webhook/v1alpha1/defaults.go
index 950a8a489..136ec1033 100644
--- a/internal/apis/config/webhook/v1alpha1/defaults.go
+++ b/internal/apis/config/webhook/v1alpha1/defaults.go
@@ -17,9 +17,10 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/pointer"
+
+	"github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1"
 )
 
 func addDefaultingFuncs(scheme *runtime.Scheme) error {
diff --git a/internal/apis/config/webhook/v1alpha1/doc.go b/internal/apis/config/webhook/v1alpha1/doc.go
index 4cb5b49c1..7271e6668 100644
--- a/internal/apis/config/webhook/v1alpha1/doc.go
+++ b/internal/apis/config/webhook/v1alpha1/doc.go
@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// +k8s:conversion-gen=github.com/jetstack/cert-manager/internal/apis/config
-// +k8s:conversion-gen-external-types=github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1
+// +k8s:conversion-gen=github.com/jetstack/cert-manager/internal/apis/config/webhook
+// +k8s:conversion-gen-external-types=github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1
 // +k8s:defaulter-gen=TypeMeta
-// +k8s:defaulter-gen-input=../../../../pkg/apis/config/v1alpha1
+// +k8s:defaulter-gen-input=../../../../../pkg/apis/config/webhook/v1alpha1
 
-// +groupName=config.cert-manager.io
+// +groupName=webhook.config.cert-manager.io
 package v1alpha1
diff --git a/internal/apis/config/webhook/v1alpha1/register.go b/internal/apis/config/webhook/v1alpha1/register.go
index 102d7dacc..117d5699d 100644
--- a/internal/apis/config/webhook/v1alpha1/register.go
+++ b/internal/apis/config/webhook/v1alpha1/register.go
@@ -17,9 +17,10 @@ limitations under the License.
 package v1alpha1
 
 import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
 	"github.com/jetstack/cert-manager/pkg/apis/config/webhook"
 	"github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
 // SchemeGroupVersion is group version used to register these objects
diff --git a/internal/apis/config/webhook/validation/BUILD.bazel b/internal/apis/config/webhook/validation/BUILD.bazel
index f6b482bbb..2b21a8ee8 100644
--- a/internal/apis/config/webhook/validation/BUILD.bazel
+++ b/internal/apis/config/webhook/validation/BUILD.bazel
@@ -3,10 +3,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = ["validation.go"],
-    importpath = "github.com/jetstack/cert-manager/internal/apis/config/validation",
+    importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/validation",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//internal/apis/config:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
         "@io_k8s_apimachinery//pkg/util/errors:go_default_library",
     ],
 )
diff --git a/internal/apis/config/webhook/validation/validation.go b/internal/apis/config/webhook/validation/validation.go
index 1ef8bb182..689aea827 100644
--- a/internal/apis/config/webhook/validation/validation.go
+++ b/internal/apis/config/webhook/validation/validation.go
@@ -21,7 +21,7 @@ import (
 
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 
-	"github.com/jetstack/cert-manager/internal/apis/config"
+	config "github.com/jetstack/cert-manager/internal/apis/config/webhook"
 )
 
 func ValidateWebhookConfiguration(cfg *config.WebhookConfiguration) error {
diff --git a/pkg/apis/BUILD.bazel b/pkg/apis/BUILD.bazel
index 012210456..92d78d3b3 100644
--- a/pkg/apis/BUILD.bazel
+++ b/pkg/apis/BUILD.bazel
@@ -20,7 +20,7 @@ filegroup(
         ":package-srcs",
         "//pkg/apis/acme:all-srcs",
         "//pkg/apis/certmanager:all-srcs",
-        "//pkg/apis/config:all-srcs",
+        "//pkg/apis/config/webhook:all-srcs",
         "//pkg/apis/experimental:all-srcs",
         "//pkg/apis/meta:all-srcs",
     ],
diff --git a/pkg/apis/config/webhook/BUILD.bazel b/pkg/apis/config/webhook/BUILD.bazel
index 08d473549..4faa3628d 100644
--- a/pkg/apis/config/webhook/BUILD.bazel
+++ b/pkg/apis/config/webhook/BUILD.bazel
@@ -3,7 +3,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = ["doc.go"],
-    importpath = "github.com/jetstack/cert-manager/pkg/apis/config",
+    importpath = "github.com/jetstack/cert-manager/pkg/apis/config/webhook",
     visibility = ["//visibility:public"],
 )
 
@@ -18,7 +18,7 @@ filegroup(
     name = "all-srcs",
     srcs = [
         ":package-srcs",
-        "//pkg/apis/config/v1alpha1:all-srcs",
+        "//pkg/apis/config/webhook/v1alpha1:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],
diff --git a/pkg/apis/config/webhook/doc.go b/pkg/apis/config/webhook/doc.go
index 590999204..d90c90388 100644
--- a/pkg/apis/config/webhook/doc.go
+++ b/pkg/apis/config/webhook/doc.go
@@ -14,9 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// +groupName=config.cert-manager.io
+// +groupName=webhook.config.cert-manager.io
 
-// Package config contains types used to configure cert-manager components
-package config
+// Package webhook contains types used to configure the webhook
+package webhook
 
-const GroupName = "config.cert-manager.io"
+const GroupName = "webhook.config.cert-manager.io"
diff --git a/pkg/apis/config/webhook/v1alpha1/BUILD.bazel b/pkg/apis/config/webhook/v1alpha1/BUILD.bazel
index 4c8995b22..151a284e8 100644
--- a/pkg/apis/config/webhook/v1alpha1/BUILD.bazel
+++ b/pkg/apis/config/webhook/v1alpha1/BUILD.bazel
@@ -5,13 +5,13 @@ go_library(
     srcs = [
         "doc.go",
         "register.go",
-        "types_webhook.go",
+        "types.go",
         "zz_generated.deepcopy.go",
     ],
-    importpath = "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1",
+    importpath = "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1",
     visibility = ["//visibility:public"],
     deps = [
-        "//pkg/apis/config:go_default_library",
+        "//pkg/apis/config/webhook:go_default_library",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
diff --git a/pkg/apis/config/webhook/v1alpha1/doc.go b/pkg/apis/config/webhook/v1alpha1/doc.go
index eb719f670..50a51f182 100644
--- a/pkg/apis/config/webhook/v1alpha1/doc.go
+++ b/pkg/apis/config/webhook/v1alpha1/doc.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Package v1alpha1 is the v1alpha1 version of the API.
+// Package v1alpha1 is the v1alpha1 version of the webhook config API.
 // +k8s:deepcopy-gen=package,register
-// +groupName=config.cert-manager.io
+// +groupName=webhook.config.cert-manager.io
 package v1alpha1
diff --git a/pkg/apis/config/webhook/v1alpha1/register.go b/pkg/apis/config/webhook/v1alpha1/register.go
index 608f9d7c4..df9f247eb 100644
--- a/pkg/apis/config/webhook/v1alpha1/register.go
+++ b/pkg/apis/config/webhook/v1alpha1/register.go
@@ -21,11 +21,11 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	"github.com/jetstack/cert-manager/pkg/apis/config"
+	"github.com/jetstack/cert-manager/pkg/apis/config/webhook"
 )
 
 // SchemeGroupVersion is group version used to register these objects
-var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: "v1alpha1"}
+var SchemeGroupVersion = schema.GroupVersion{Group: webhook.GroupName, Version: "v1alpha1"}
 
 // Resource takes an unqualified resource and returns a Group qualified GroupResource
 func Resource(resource string) schema.GroupResource {
diff --git a/pkg/apis/config/webhook/v1alpha1/types.go b/pkg/apis/config/webhook/v1alpha1/types.go
index 20064b59f..441bcbd9d 100644
--- a/pkg/apis/config/webhook/v1alpha1/types.go
+++ b/pkg/apis/config/webhook/v1alpha1/types.go
@@ -32,7 +32,7 @@ type WebhookConfiguration struct {
 	HealthzPort *int `json:"healthzPort,omitempty"`
 
 	// tlsConfig is used to configure the secure listener's TLS settings.
-	TLSConfig WebhookTLSConfig `json:"tlsConfig"`
+	TLSConfig TLSConfig `json:"tlsConfig"`
 
 	// kubeConfig is the kubeconfig file used to connect to the Kubernetes apiserver.
 	// If not specified, the webhook will attempt to load the in-cluster-config.
@@ -50,9 +50,9 @@ type WebhookConfiguration struct {
 	PprofAddress string `json:"pprofAddress,omitempty"`
 }
 
-// WebhookTLSConfig configures how TLS certificates are sourced for serving.
+// TLSConfig configures how TLS certificates are sourced for serving.
 // Only one of 'filesystem' or 'dynamic' may be specified.
-type WebhookTLSConfig struct {
+type TLSConfig struct {
 	// cipherSuites is the list of allowed cipher suites for the server.
 	// Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants).
 	// If not specified, the default for the Go version will be used and may change over time.
@@ -65,7 +65,7 @@ type WebhookTLSConfig struct {
 
 	// Filesystem enables using a certificate and private key found on the local filesystem.
 	// These files will be periodically polled in case they have changed, and dynamically reloaded.
-	Filesystem WebhookFilesystemServingConfig `json:"filesystem"`
+	Filesystem FilesystemServingConfig `json:"filesystem"`
 
 	// When Dynamic serving is enabled, the webhook will generate a CA used to sign webhook
 	// certificates and persist it into a Kubernetes Secret resource (for other replicas of the
@@ -73,12 +73,12 @@ type WebhookTLSConfig struct {
 	// It will then generate a certificate in-memory for itself using this CA to serve with.
 	// The CAs certificate can then be copied into the appropriate Validating, Mutating and Conversion
 	// webhook configuration objects (typically by cainjector).
-	Dynamic WebhookDynamicServingConfig `json:"dynamic"`
+	Dynamic DynamicServingConfig `json:"dynamic"`
 }
 
-// WebhookDynamicServingConfig makes the webhook generate a CA and persist it into Secret resources.
+// DynamicServingConfig makes the webhook generate a CA and persist it into Secret resources.
 // This CA will be used by all instances of the webhook for signing serving certificates.
-type WebhookDynamicServingConfig struct {
+type DynamicServingConfig struct {
 	// Namespace of the Kubernetes Secret resource containing the TLS certificate
 	// used as a CA to sign dynamic serving certificates.
 	SecretNamespace string `json:"secretNamespace,omitempty"`
@@ -91,9 +91,9 @@ type WebhookDynamicServingConfig struct {
 	DNSNames []string `json:"dnsNames,omitempty"`
 }
 
-// WebhookFilesystemServingConfig enables using a certificate and private key found on the local filesystem.
+// FilesystemServingConfig enables using a certificate and private key found on the local filesystem.
 // These files will be periodically polled in case they have changed, and dynamically reloaded.
-type WebhookFilesystemServingConfig struct {
+type FilesystemServingConfig struct {
 	// Path to a file containing TLS certificate & chain to serve with
 	CertFile string `json:"certFile,omitempty"`
 
diff --git a/pkg/webhook/configfile/BUILD.bazel b/pkg/webhook/configfile/BUILD.bazel
index 763c62dbc..643e89c2e 100644
--- a/pkg/webhook/configfile/BUILD.bazel
+++ b/pkg/webhook/configfile/BUILD.bazel
@@ -6,8 +6,8 @@ go_library(
     importpath = "github.com/jetstack/cert-manager/pkg/webhook/configfile",
     visibility = ["//visibility:public"],
     deps = [
-        "//internal/apis/config:go_default_library",
-        "//internal/apis/config/scheme:go_default_library",
+        "//internal/apis/config/webhook:go_default_library",
+        "//internal/apis/config/webhook/scheme:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library",
     ],
 )
diff --git a/pkg/webhook/configfile/configfile.go b/pkg/webhook/configfile/configfile.go
index f7a31996d..65b874fcf 100644
--- a/pkg/webhook/configfile/configfile.go
+++ b/pkg/webhook/configfile/configfile.go
@@ -23,8 +23,8 @@ import (
 
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 
-	"github.com/jetstack/cert-manager/internal/apis/config"
-	"github.com/jetstack/cert-manager/internal/apis/config/scheme"
+	config "github.com/jetstack/cert-manager/internal/apis/config/webhook"
+	"github.com/jetstack/cert-manager/internal/apis/config/webhook/scheme"
 )
 
 // Filesystem is an interface used to mock out calls to ReadFile
diff --git a/pkg/webhook/configfile/configfile_test.go b/pkg/webhook/configfile/configfile_test.go
index 29e2019e6..475960b30 100644
--- a/pkg/webhook/configfile/configfile_test.go
+++ b/pkg/webhook/configfile/configfile_test.go
@@ -30,7 +30,7 @@ func TestFSLoader_Load(t *testing.T) {
 			t.Fatalf("unexpected filename %q passed to ReadFile", filename)
 			return nil, fmt.Errorf("unexpected filename %q", filename)
 		}
-		return []byte(fmt.Sprintf(`apiVersion: config.cert-manager.io/v1alpha1
+		return []byte(fmt.Sprintf(`apiVersion: webhook.config.cert-manager.io/v1alpha1
 kind: WebhookConfiguration
 kubeConfig: %s`, kubeConfigPath)), nil
 	}), expectedFilename)