<p>Evening!</p>
<p>I'm wondering if anyone could share the steps for updating the certificates on OpenShift + Kubernetes 4.6?  I've checked using the below command and some are expired.</p>
<p><code>find /etc/kubernetes/ -type f -name &quot;*.crt&quot; -print|egrep -v 'ca.crt$'|xargs -L 1 -t  -i bash -c 'openssl x509  -noout -text -in {}|grep After'</code></p>
<p>I'm not able to find relevant steps to my UPN install.  The following certificates are expired as well.</p>
<p><code>81789506 lrwxrwxrwx. 1 root root   59 Jan  9 00:32 kubelet-server-current.pem -&gt; /var/lib/kubelet/pki/kubelet-server-2021-06-18-20-35-33.pem 81800208 lrwxrwxrwx. 1 root root   59 Jan  9 00:32 kubelet-client-current.pem -&gt; /var/lib/kubelet/pki/kubelet-client-2021-06-19-13-16-00.pem</code></p>
<p>Since the API server is offline, I'm not able to renew the certificates via oc commands.  All OC commands return an error since the API server ( port 6443 ) is offline. This cluster is installed on VMware using the UPI method. There was a failure sometime back taking the cluster offline.  When the cluster was brought back up, the certs were already expired and could not renew since services needed for that were offline I think?</p>
<p>Wondering if anyone managed to recover from this scenario and would be able to help?</p>

<p>Did you check the official doc on that subject?<br />
It may help you<br />
<a href="https://docs.openshift.com/container-platform/4.6/backup_and_restore/control_plane_backup_and_restore/disaster_recovery/scenario-3-expired-certs.html" rel="nofollow noreferrer">https://docs.openshift.com/container-platform/4.6/backup_and_restore/control_plane_backup_and_restore/disaster_recovery/scenario-3-expired-certs.html</a><br />
But if you can't login to your cluster, it may be quite difficult...</p>
