<p>I've recently upgraded with kubeadm, which I expect to rotate all certificates, and for good measure, I also ran <code>kubeadm init phase certs all</code>, but I'm not sure what steps are required to verify that the certs are all properly in place and not about to expire.</p>

<p>I've seen a <a href="https://stackoverflow.com/a/56334732/238322">SO answer reference</a> <code>kubeadm init phase kubeconfig all</code> is required in addition, but cannot find in the <a href="https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/" rel="nofollow noreferrer">kubernetes kubeadm documentation</a> telling me that it needs to be used in conjunction with phase certs. </p>

<p>What do I need to do to make sure that the cluster will not encounter expired certificates?</p>

<p>I've tried verifying by connecting to the secure local port: <code>echo -n | openssl s_client -connect localhost:10250 2&gt;&amp;1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not</code>, which gives me expirations next month.</p>

<p>While <code>openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text</code> and <code>openssl x509 -in /etc/kubernetes/pki/apiserver-kubelet-client.crt -noout -text</code> yield dates over a year in advance.</p>

<p>These conflicting dates certainly have me concerned that I will find myself like many others with expired certificates. How do I get in front of that?</p>

<p>Thank you for any guidance.</p>

<p>In essence <code>kubeadm init phase certs all</code> regenerates all your certificates including your <code>ca.crt</code> (Certificate Authority), and Kubernetes components use certificate-based authentication to connect to the kube-apiserver (kubelet, kube-scheduler, kube-controller-manager) so you will also have to regenerate pretty much all of those configs by running <code>kubeadm init phase kubeconfig all</code></p>

<p>Keep in mind that you will have to regenerate the <code>kubelet.conf</code> on all your nodes since it also needs to be updated to connect to the kube-apiserver with the new <code>ca.crt</code>. Also, make sure you <a href="https://stackoverflow.com/a/53074575/2989261">add all your hostnames/IP addresses</a> that your kube-apiserver is going to serve on to the <code>kubeadm init phase certs all</code> command (<code>--apiserver-cert-extra-sans</code>)</p>

<p>Most likely you are not seeing the updated certs when connecting through <code>openssl</code> is because you haven't restarted the Kubernetes components and in particular the kube-apiserver.  So you will have to start your kube-apiserver, kube-scheduler, kube-controller-manager, etc (or kube-apiservers, kube-schedulers, etc if you are running a multi-master control plane) You will also have to restart your kubelets on all your nodes. </p>
