<p>I just lost access to my k3s.</p>
<p>I had the certs check this week to if if they had been auto-updated... and it seen so:</p>
<pre><code>[root@vmpkube001 tls]# for crt in *.crt; do      printf '%s: %s\n'      &quot;$(date --date=&quot;$(openssl x509 -enddate -noout -in &quot;$crt&quot;|cut -d= -f 2)&quot; --iso-8601)&quot;      &quot;$crt&quot;; done | sort
2021-09-18: client-admin.crt
2021-09-18: client-auth-proxy.crt
2021-09-18: client-cloud-controller.crt
2021-09-18: client-controller.crt
2021-09-18: client-k3s-controller.crt
2021-09-18: client-kube-apiserver.crt
2021-09-18: client-kube-proxy.crt
2021-09-18: client-scheduler.crt
2021-09-18: serving-kube-apiserver.crt
2029-11-03: client-ca.crt
2029-11-03: request-header-ca.crt
2029-11-03: server-ca.crt
</code></pre>
<p>but the cli is broken:
<a href="https://i.stack.imgur.com/Y3fRC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y3fRC.png" alt="image" /></a></p>
<p>Same goes to the dashboard:</p>
<p><a href="https://i.stack.imgur.com/hUQuO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hUQuO.png" alt="image" /></a></p>
<p>The cluster &quot;age&quot; was about 380~something days.
I am running a &quot;v1.18.12+k3s1&quot; in a centos7 cluster.</p>
<p>I change the date on the server to be able to execute kubectl again...
<a href="https://i.stack.imgur.com/s3dJS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/s3dJS.png" alt="enter image description here" /></a>
The secrets are wrong... how to update this?</p>
<p>Node logs:</p>
<pre><code>Nov 18 16:34:17 pmpnode001.agrotis.local k3s[6089]: time=&quot;2020-11-18T16:34:17.400604478-03:00&quot; level=error msg=&quot;server https://127.0.0.1:33684/cacerts is not trusted: Get https://127.0.0.1:33684/cacerts: x509: certificate has expired or is not yet valid&quot;
</code></pre>
<p>Not only that but every case of this problem in the internet says somethings about kubeadm alpha certs. There is no kubeadm, and the only &quot;alpha&quot; feature i have in kubeclt is debug.</p>

<p>I got it working.</p>
<p>it turn out that there is some bug in the auto-renew process. It has been patch up but they forgot to backport it to the 1.18 branch.
I Had to update it to 1.19.4 to get it working.</p>
