<p>I have a coreos kubernetes cluster, which I started by following this article: </p>

<p><a href="https://coreos.com/kubernetes/docs/latest/kubernetes-on-aws.html" rel="nofollow">kubernetes coreos cluster on AWS</a></p>

<p>TLDR; </p>

<pre><code>&gt; kube-aws init
&gt; kube-aws render
&gt; kube-aws up
</code></pre>

<p>Everything worked good and I had a kubernetes coreos cluster on AWS. 
In the article there is a warning that said:</p>

<blockquote>
  <p>PRODUCTION NOTE: the TLS keys and certificates generated by kube-aws
  should not be used to deploy a production Kubernetes cluster. Each
  component certificate is only valid for 90 days, while the CA is valid
  for 365 days. If deploying a production Kubernetes cluster, consider
  establishing PKI independently of this tool first.</p>
</blockquote>

<p>So I wanted to replace the default certificates, so I followed the following article: </p>

<p><a href="https://coreos.com/kubernetes/docs/latest/openssl.html" rel="nofollow">coreos certificates</a></p>

<p>TLDR;</p>

<ol>
<li>created the following self signed certificates: ca.pem, ca-key.pem</li>
<li>created the certificates for the controller: apiserver.pem, apiserver-key.pem</li>
<li>Replaced the certificates in the controller with the certificates created above, and rebooted the controller</li>
<li>created a worker certificates and replaced the certificates in the workers and rebooted them</li>
<li>configured kubectl to use the new certificates i created and also configured the context and user</li>
</ol>

<p>Im getting a communication error between kubectl and the cluster, complaining about the certificate</p>

<blockquote>
  <p>Unable to connect to the server: x509: certificate signed by unknown
  authority</p>
</blockquote>

<p>I also tried to use a signed certificate for kubectl which points to the cluster DNS, I set a DNS for the cluster. </p>

<p>How do I make kubectl communicate with my cluster? </p>

<p>Thanks in advance</p>

<p>EDIT:</p>

<p>My <strong>~/.kube/config</strong> looks like this:</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority: /Users/Yariv/Development/workspace/bugeez/bugeez-kubernetes/credentials/ca2.pem
    server: https://kubernetes.bugeez.io
  name: bugeez
contexts:
- context:
    cluster: bugeez
    user: bugeez-admin
  name: bugeez-system
current-context: bugeez-system
kind: Config
preferences: {}
users:
- name: bugeez-admin
  user:
    client-certificate: /Users/Yariv/Development/workspace/bugeez/bugeez-kubernetes/credentials/admin2.pem
    client-key: /Users/Yariv/Development/workspace/bugeez/bugeez-kubernetes/credentials/admin-key2.pem
</code></pre>

<p>EDIT:</p>

<p>All my certificates are signed by ca2.pem, I also validated this fact by running: </p>

<pre><code>openssl verify -CAfile ca2.pem &lt;certificate-name&gt;
</code></pre>

<p>EDIT:</p>

<p>What I think is the cause of the error is this: 
When I switch the keys in the controller and workers, seems like cloud-config is overwriting my new keys with the old ones. How do I replace the keys and also change cloud-config to adapt to my change?</p>

<p>An alternative solution that worked for me was to start a new cluster, and use custom certificates initially, without ever relying on the default temporary credentials.</p>

<p>Following the same <a href="https://coreos.com/kubernetes/docs/latest/openssl.html" rel="nofollow">tutorial</a> that you used, I made the following changes:</p>

<pre><code>&gt; kube-aws init
&gt; kube-aws render
</code></pre>

<p>Before <code>kube-aws up</code>, I created the certificates by following the tutorial.  The only issue with the tutorial is that it is geared toward creating new certificates for an existing cluster.  Therefore, the following changes are necessary:</p>

<ul>
<li><p>This line: <code>$ openssl req -x509 -new -nodes -key ca-key.pem -days 10000 -out ca.pem -subj "/CN=kube-ca"</code> needs to be replaced by: <code>$ openssl req -x509 -new -nodes -key ca-key.pem -days 10000 -out ca.pem</code></p></li>
<li><p>In the openssl.cnf file, remove the lines that define the IP for the master host, and the loadbalancer, since we don't know what they will be yet.  The final openssl.cnf should look something like this:        </p></li>
</ul>

<p><strong>openssl.cnf</strong></p>

<pre><code>[req]
...
[req_distinguished_name]
[ v3_req ]
...
[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster.local
DNS.5 = mydomain.net
IP.1 = ${K8S_SERVICE_IP} # 10.3.0.1
IP.2 = ${MASTER_IP} # 10.0.0.50
</code></pre>

<p>I also used the same worker certificate for all the worker nodes. </p>

<p>After the certificates are in place, enter <code>kube-aws up</code>. </p>

<p>I hope this helps you get off the ground</p>
