<p>While creating the kubernetes cluster using kubeadm in Centos 7, its creating one year kubeapi certificate. For me this is short time for the cluster. How can I create 5 year certificate during cluster setup?</p>

<pre><code>* SSL connection using TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
* Server certificate:
*       subject: CN=kube-apiserver
*       start date: Dec 20 14:32:00 2017 GMT
*       expire date: Dec 20 14:32:00 2018 GMT
*       common name: kube-apiserver
*       issuer: CN=kubernetes
</code></pre>

<p>I tried this didn't work:</p>

<pre><code>openssl genrsa -out ca.key 2048
export MASTER_IP=192.168.16.171
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
kubeadm reset
rm -rf /etc/kubernetes
mkdir -p /etc/kubernetes/ca/pki
cp ca.key ca.crt /etc/kubernetes/ca/pki/
kubeadm init
curl -k -v https://localhost:6443

Server certificate:
*       subject: CN=kube-apiserver
*       start date: Apr 15 21:07:24 2018 GMT
*       expire date: Apr 15 21:07:25 2019 GMT
*       common name: kube-apiserver
*       issuer: CN=kubernetes
</code></pre>

<p>Thanks
SR</p>

<p>Follow the Kubernetes documentation on <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">certificates</a> to the CA certificate.</p>

<p>If you choose <code>openssl</code> or <code>easyrsa</code> use <code>--days=1825</code>, if you are going with <code>cfssl</code> then in <code>ca-config.json</code> specify <code>5y</code> for <code>.signing.default.expiry</code>.</p>

<p>Put the resulting <code>ca.crt</code> and <code>ca.key</code> in <code>/etc/kubernetes/ca/pki</code>. When you run <code>kubeadm init</code> it will detect those files and will not overwrite them; it will use that CA key &amp; certificate to sign the other certificates needed.</p>
