Manual Rotation of CA Certificates [page]deterministic
This page shows how to manually rotate the certificate authority (CA) certificates.
##
- For more information about authentication in Kubernetes, see [Authenticating](/docs/reference/access-authn-authz/authentication).
- For more information about best practices for CA certificates, see [Single root CA](/docs/setup/best-practices/certificates/#single-root-ca).
## Rotate the CA certificates manually
> Caution: Make sure to back up your certificate directory along with configuration files and any other necessary files.
This approach assumes operation of the Kubernetes control plane in an HA configuration with multiple API servers. Graceful termination of the API server is also assumed, so clients can cleanly disconnect from one API server and reconnect to another.
Configurations with a single API server will experience unavailability while the API server is being restarted.
1. Distribute the new CA certificates and private keys (for example: `ca.crt`, `ca.key`, `front-proxy-ca.crt`, and `front-proxy-ca.key`) to all your control plane nodes in the Kubernetes certificates directory.
1. Update the `--root-ca-file` flag for the [kube-controller-manager](#gloss:kube-controller-manager) to include both old and new CA, then restart the kube-controller-manager.
Any [ServiceAccount](#gloss:service-account) created after this point will get Secrets that include both old and new CAs.
> Note: The files specified by the kube-controller-manager flags `--client-ca-file` and `--cluster-signing-cert-file` cannot be CA bundles. If these flags and `--root-ca-file` point to the same `ca.crt` file, which is now a bundle (includes both old and new CA), you will face an error. To workaround this problem, you can copy the new CA to a separate file and make the flags `--client-ca-file` and `--cluster-signing-cert-file` point to the copy. Once `ca.crt` is no longer a bundle, you can restore the problem flags to point to `ca.crt` and delete the copy.
[Issue 1350](https://github.com/kubernetes/kubeadm/issues/1350) for kubeadm tracks an bug with the kube-controller-manager being unable to accept a CA bundle.
1. Wait for the controller manager to update `ca.crt` in the service account Secrets to include both old and new CA certificates.
If any Pods are started before the new CA is used by API servers, the new Pods get this update and will trust both old and new CAs.
1. Restart all pods using in-cluster configurations (for example: kube-proxy, CoreDNS, etc) so they can use the updated certificate authority data from Secrets that link to ServiceAccounts.
* Make sure CoreDNS, kube-proxy, and other Pods using in-cluster configurations are working as expected.
1. Append both old and new CA to the file against `--client-ca-file` and `--kubelet-certificate-authority` flag in the `kube-apiserver` configuration.
1. Append both old and new CA to the file against the `--client-ca-file` flag in the `kube-scheduler` configuration.
1. Update certificates for user accounts by replacing the content of `client-certificate-data` and `client-key-data` respectively.
For information about creating certificates for individual user accounts, see [Configure certificates for user accounts](/docs/setup/best-practices/certificates/#configure-certificates-for-user-accounts).
Additionally, update the `certificate-authority-data` section in the kubeconfig files, respectively with Base64-encoded old and new certificate authority data
1. Update the `--root-ca-file` flag for the [cloud-controller-manager](#gloss:cloud-controller-manager) to include both old and new CA, then restart the cloud-controller-manager.
> Note: If your cluster does not have a cloud-controller-manager, you can skip this step.
1. Follow the steps below in a rolling fashion.
1. Restart any other [aggregated API servers](/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation …(trimmed)