In earlier TAP (Tanzu Application Platform) versions, there were two net-certmanager deployments in knative-serving namespace.
$ kubectl -n knative-serving get deploy
NAME READY UP-TO-DATE AVAILABLE AGE
activator 3/3 3 3 63d
autoscaler 1/1 1 1 63d
autoscaler-hpa 1/1 1 1 63d
controller 1/1 1 1 63d
domain-mapping 1/1 1 1 63d
domainmapping-webhook 1/1 1 1 63d
net-certmanager-controller 1/1 1 1 63d <<<
net-certmanager-webhook 1/1 1 1 63d <<<
net-contour-controller 1/1 1 1 63d
webhook 2/2 2 2 63d
However, post upgrade to TAP v1.12, you might observe that the two net-certmanager deployments disappear.
There is a change in TAP (Tanzu Application Platform) v1.12 that the net-certmanager is not going to have its separate pod but run on the same pod as serving. This change is not being documented in the TAP release notes. And this change would not bring any meaningful impact to the performance. You could contact the Tanzu support team shall you need any additional clarification.