# Update the CA used by the cluster **URL:** \ **Category:** microk8s\ **Tags:** docs\ **Created:** [August 18, 2020, 11:24am UTC](https://discuss.kubernetes.io/t/update-the-ca-used-by-the-cluster/12466 "2020-08-18T11:24:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kjackal](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/kjackal/32/1750_2.png) [@kjackal](https://discuss.kubernetes.io/u/kjackal)\ **Post date:** [August 18, 2020, 11:24am UTC](https://discuss.kubernetes.io/t/update-the-ca-used-by-the-cluster/12466/1 "2020-08-18T11:24:06Z")
A self-signed CA is created by MicroK8s at install time. Starting from the 1.19 release, it is possible to refresh that CA with an auto-generated one or to configure Kubernetes to use a user-provided one. This functionality is provided via the `microk8s refresh-certs` command. ## Using the `refresh-certs` command - To prove a CA you have to: ```auto sudo microk8s refresh-certs ./ca-path/ ``` The `ca-path` above is the directory containing the two files `ca.crt` and `ca.key`. - To let MicroK8s replace the CA with an auto-generated one: ```auto sudo microk8s refresh-certs ``` - To undo the last operation you can use the `-u` flag: ```auto sudo microk8s refresh-certs -u ``` - To check the expiration time of the installed CA: ```auto sudo microk8s refresh-certs -c ``` ## Known limitations - An update of the CA should be made in a cluster without any workloads. Auxiliary certificates and credentials make use of the CA, so updating the CA in a live cluster will have unpredictable effects. - In a multi-node setup, nodes will need to leave and rejoin the cluster in order for new certificates to properly propagate. ---
**Author:** ![canerbis](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/canerbis/32/9637_2.png) [@canerbis](https://discuss.kubernetes.io/u/canerbis)\ **Post date:** [March 30, 2022, 5:41am UTC](https://discuss.kubernetes.io/t/update-the-ca-used-by-the-cluster/12466/2 "2022-03-30T05:41:36Z")
Thank you for your proceduers. I executed the refresh-certs command with your proceduers. There were various certifcates at /var/snap/microk8s/current/certs. I checked the certifcates for expried period. But It was not changed the only kubelet.crt. As far as I know, kubelet.crt is rotated aotomactically by apiserver on k8s. But I can’t find the configuration of kubelet.crt for rotation on microk8s. If you know about it , Please Let me Know Where the configuration of kubelet.crt is. I need to explain the configuration of kubelet.crt for my client Best Regard Canerbis. ---
**Author:** ![canerbis](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/canerbis/32/9637_2.png) [@canerbis](https://discuss.kubernetes.io/u/canerbis)\ **Post date:** [November 18, 2022, 2:07am UTC](https://discuss.kubernetes.io/t/update-the-ca-used-by-the-cluster/12466/3 "2022-11-18T02:07:42Z")
I have found about renewing kubelet.crt # check if kubelet.crt is expired echo -n | openssl s\_client -connect localhost:10250 2\>&1 | sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’ | openssl x509 -text -noout | grep -A 2 Validity # Auto-rotate Setting about kubele.crt vi /var/snap/microk8s/current/args/kubelet # Adding below 3 lines –rotate-certificates=true –rotate-server-certificates=true –tls-cipher-suites=TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 micok8s stop;microk8s start microk8s kubectl get csr microk8s kubectl certificate approve # check if kubelet.crt is renewed echo -n | openssl s\_client -connect localhost:10250 2\>&1 | sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’ | openssl x509 -text -noout | grep -A 2 Validity cd /var/snap/microk8s/current/certs ls kubelet-client-current.pem kubelet-server-current.pem PS: If i am wrong, Let me know ---
**Author:** ![darwin1357](https://avatars.discourse-cdn.com/v4/letter/d/ce7236/32.png) [@darwin1357](https://discuss.kubernetes.io/u/darwin1357)\ **Post date:** [March 30, 2024, 11:11pm UTC](https://discuss.kubernetes.io/t/update-the-ca-used-by-the-cluster/12466/4 "2024-03-30T23:11:38Z")
Excellent post! Hugh time saver. ---
**Author:** ![Adam\_Esslinger](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/adam_esslinger/32/15496_2.png) [@Adam\_Esslinger](https://discuss.kubernetes.io/u/Adam_Esslinger)\ **Post date:** [July 31, 2024, 4:29pm UTC](https://discuss.kubernetes.io/t/update-the-ca-used-by-the-cluster/12466/5 "2024-07-31T16:29:15Z")
these lines for enabling auto renewal. Do these stanzas go on the first controller only, or all controllers, or all controllers and all worker nodes?