Turns out running the command with sudo fixed the error. Didn't think to try that based on the error and the KB article on cert manager didn't seem to mention the need to.
