<p>i have an issue with an expiring cert on one of our kubernetes nodes.
Checking the cert which is used on port 10250, the result is telling me the cert will expire on July 23:</p>
<p><a href="https://i.stack.imgur.com/kiWCH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kiWCH.png" alt="enter image description here" /></a></p>
<p>I have checked the certificate which is used by kubelet service which shows me this information:</p>
<p><a href="https://i.stack.imgur.com/Cf1Rk.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Cf1Rk.png" alt="enter image description here" /></a></p>
<p>I double-checked all certs, I am aware of located at /etc/kuberbetes/pki as well as at /var/lib/kubelet/pki. All certs on that locations are valid and do not expire.</p>
<p>Is there another location with certs that I am missing here?</p>

Niku
<p>The <code>kubelet-client-current.pem</code> you're looking at is the client certificate that Kubelet would use, authenticating with the Kubernetes API.</p>
<p>The server certificate you're looking for should be the <code>/var/lib/kubelet/kubelet.crt</code> one.</p>
<pre><code># openssl x509 -text -noout -in /var/lib/kubelet/pki/kubelet-client-current.pem  | grep -A4 'X509v3 extensions'
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication

# openssl x509 -text -noout -in /var/lib/kubelet/pki/kubelet.crt  | grep -A4 'X509v3 extensions'
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
</code></pre>
<p>The first one serves to authenticate a client, the later a server.</p>
