<p>I ran into issue with expired certificates on k8s cluster. I am running version 1.6.1 for over a year now, meaning that my certificates expired and I have to renew them.
In newer versions this is already done automatically, but I currently can not upgrade my cluster to higher version, so I have to create certificates manually.</p>

<p>I came across following <a href="https://medium.com/@AnushkaSandaru1/how-to-change-expired-certificates-in-kubernetes-cluster-5d3feb9d9838" rel="nofollow noreferrer">link</a>, where it is described step-by-step, but I am actually already stuck on creating openssl.cnf file, as I am missing parameters. At the same time, this option is using .pem key, while on cluster currently .crt and .key pairs are used.</p>

<p>Any suggestion how to move forward with this? I have also tried running <code>kubeadm alpha phase certs selfsign</code> command, which created new certificates, yet I am still running into issue that api-server is refusing TSL handshake.</p>

<pre><code>http: TLS handshake error from IP:port: remote error: tls: bad certificate
</code></pre>

<p>Thank you and best regards,</p>

<p>Bostjan</p>

<p><strong>There is a detailed <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">guide on how to generate certificates</a>.</strong></p>

<p>While you are following that guide look out for a few gotchas:</p>

<ul>
<li>Make sure your CA certificate is valid for the period you are trying to extend the other certificates to. The validity of any certificates signed by the CA certificate are <em>also</em> limited by the expiration date of the CA certificate.</li>
<li>If the validity period of the CA certificate itself is too short you are in a pickle. Replacing that certificate will require modifying all kubeconfigs (operators, cluster components).</li>
<li>For the same reason as above, make very sure you don't overwrite the CA key/certificate accidentaly.</li>
<li>When replacing the certificate for the apiserver you will need to restart the apiserver. The apiserver does not reread the certificate automatically.</li>
</ul>
