# KOTS: What do I do when a customer's Kubernetes certificate has expired?

**URL:** <https://community.replicated.com/t/kots-what-do-i-do-when-a-customers-kubernetes-certificate-has-expired/626>\
**Category:** Supporting your customers\
**Tags:** kots\
**Created:** [December 30, 2021, 5:45pm UTC](https://community.replicated.com/t/kots-what-do-i-do-when-a-customers-kubernetes-certificate-has-expired/626 "2021-12-30T17:45:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mariel\_Wilding](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/mariel_wilding/32/231_2.png) [@Mariel\_Wilding](https://community.replicated.com/u/Mariel_Wilding)\
**Post date:** [December 30, 2021, 5:45pm UTC](https://community.replicated.com/t/kots-what-do-i-do-when-a-customers-kubernetes-certificate-has-expired/626/1 "2021-12-30T17:45:46Z")

</div>

Run the command `kubeadm alpha certs renew all` to manually update the certificate. If this command does not work and errors out you might be running a newer Kubernetes version that no longer has any experimental “alpha” commands. This means you will need to run `kubeadm certs renew all`

Here are some resources on certificate rotation to ensure certificates are rotated and don’t expire:

[Managing Certificates for Kubernetes Components](https://community.replicated.com/docs/kubernetes/customer-installations/certificates/)

[Embedded kURL Cluster Operator (EKCO) Add-On](https://kurl.sh/docs/add-ons/ekco#tls-certificate-rotation)

---

<div class="post-metadata">

**Author:** ![diamon\_w](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/diamon_w/32/150_2.png) [@diamon\_w](https://community.replicated.com/u/diamon_w)\
**Post date:** [July 29, 2022, 2:35pm UTC](https://community.replicated.com/t/kots-what-do-i-do-when-a-customers-kubernetes-certificate-has-expired/626/2 "2022-07-29T14:35:34Z")

</div>

In addition to running `kubeadm certs renew all` you also need to run the following to ensure the latest certificates are used by the Kubernetes control plane. If you’re running an older Kubernetes version, then you might want to run `kubeadm alpha certs renew all`:

`mv /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/ && sleep 1 && mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/`

`mv /etc/kubernetes/manifests/kube-controller-manager.yaml /tmp/ && sleep 1 && mv /tmp/kube-controller-manager.yaml /etc/kubernetes/manifests/`

`mv /etc/kubernetes/manifests/kube-scheduler.yaml /tmp/ && sleep 1 && mv /tmp/kube-scheduler.yaml /etc/kubernetes/manifests/`

Full details available here - [https://kurl.sh/docs/install-with-kurl/setup-tls-certs#manual-renewal](https://kurl.sh/docs/install-with-kurl/setup-tls-certs#manual-renewal)