title: How to update k8s certificates safely and completely？
body: <p>How to update k8s certificate:</p>
  
  <p>Some certificates in the k8s cluster are currently expired, prompting: </p>
  
  <blockquote>
    <p>Unable to connect to the server: x509: certificate has expired or is
    not yet valid. Take a look at the online cluster master.</p>
  </blockquote>
  
  <p>The <code>ca.crt</code> and <code>front-proxy-ca.crt</code> are not expired, but the <code>front-proxy-client.crt</code>, <code>apiserver-kubelet-client.crt</code>, and <code>apiserver.crt</code> are expired.</p>
  
  <p>So manually passing the existing <code>ca.key</code> generates the <code>apiserver.crt</code> on the master<a href="https://stackoverflow.com/questions/49885636/kubernetes-expired-certificate">Refer to here</a>. However, new errors occurred, suggesting: </p>
  
  <blockquote>
    <p>the server has asked for the client to provide credentials</p>
  </blockquote>
  
  <p>What is the way to update the certificate of k8s cluster?</p>
  
  <p>thanks!</p>