diff --git a/pkg/api/util/conditions.go b/pkg/api/util/conditions.go
index 986bcb874..30df531d2 100644
--- a/pkg/api/util/conditions.go
+++ b/pkg/api/util/conditions.go
@@ -270,6 +270,7 @@ func CertificateRequestReadyReason(cr *cmapi.CertificateRequest) string {
 		cmapi.CertificateRequestReasonFailed,
 		cmapi.CertificateRequestReasonIssued,
 		cmapi.CertificateRequestReasonPending,
+		cmapi.CertificateRequestReasonDenied,
 	} {
 		for _, con := range cr.Status.Conditions {
 			if con.Type == cmapi.CertificateRequestConditionReady &&
diff --git a/pkg/controller/certificaterequests/util/reporter.go b/pkg/controller/certificaterequests/util/reporter.go
index 48175547a..d07457af7 100644
--- a/pkg/controller/certificaterequests/util/reporter.go
+++ b/pkg/controller/certificaterequests/util/reporter.go
@@ -59,6 +59,20 @@ func (r *Reporter) Failed(cr *cmapi.CertificateRequest, err error, reason, messa
 
 }
 
+func (r *Reporter) Denied(cr *cmapi.CertificateRequest) {
+	// Set the FailureTime to c.clock.Now(), only if it has not been already set.
+	if cr.Status.FailureTime == nil {
+		nowTime := metav1.NewTime(r.clock.Now())
+		cr.Status.FailureTime = &nowTime
+	}
+
+	message := "The CertificateRequest was denied by an approval controller"
+
+	r.recorder.Event(cr, corev1.EventTypeWarning, cmapi.CertificateRequestReasonDenied, message)
+	apiutil.SetCertificateRequestCondition(cr, cmapi.CertificateRequestConditionReady,
+		cmmeta.ConditionFalse, cmapi.CertificateRequestReasonDenied, message)
+}
+
 func (r *Reporter) InvalidRequest(cr *cmapi.CertificateRequest, reason, message string) {
 	apiutil.SetCertificateRequestCondition(cr, cmapi.CertificateRequestConditionInvalidRequest,
 		cmmeta.ConditionTrue, reason, message)
diff --git a/pkg/controller/certificaterequests/util/reporter_test.go b/pkg/controller/certificaterequests/util/reporter_test.go
index 2ef09b349..56b25e214 100644
--- a/pkg/controller/certificaterequests/util/reporter_test.go
+++ b/pkg/controller/certificaterequests/util/reporter_test.go
@@ -100,6 +100,14 @@ func TestReporter(t *testing.T) {
 		LastTransitionTime: &nowMetaTime,
 	}
 
+	deniedReadyCondition := cmapi.CertificateRequestCondition{
+		Type:               cmapi.CertificateRequestConditionReady,
+		Reason:             "RequestDenied",
+		Message:            "The CertificateRequest was denied by an approval controller",
+		Status:             "False",
+		LastTransitionTime: &nowMetaTime,
+	}
+
 	tests := map[string]reporterT{
 		"a failed report should update the conditions and set FailureTime as it is nil": {
 			certificateRequest: gen.CertificateRequestFrom(baseCR),
@@ -204,6 +212,20 @@ func TestReporter(t *testing.T) {
 
 			call: "ready",
 		},
+
+		"a denied report should update the conditions and send an event, but not update failure time if existing": {
+			certificateRequest: gen.CertificateRequestFrom(baseCR,
+				gen.SetCertificateRequestStatusCondition(deniedReadyCondition),
+				gen.SetCertificateRequestFailureTime(oldMetaTime),
+			),
+			expectedEvents: []string{
+				"Warning RequestDenied The CertificateRequest was denied by an approval controller",
+			},
+			expectedConditions:  []cmapi.CertificateRequestCondition{deniedReadyCondition},
+			expectedFailureTime: &oldMetaTime,
+
+			call: "denied",
+		},
 	}
 
 	for name, test := range tests {
@@ -228,6 +250,8 @@ func (tt *reporterT) runTest(t *testing.T) {
 	case "pending":
 		reporter.Pending(tt.certificateRequest, tt.err,
 			tt.reason, tt.message)
+	case "denied":
+		reporter.Denied(tt.certificateRequest)
 	default:
 		reporter.Ready(tt.certificateRequest)
 	}