# Certificate renewal

**URL:** <https://forums.suse.com/t/certificate-renewal/14424>\
**Category:** SUSE Rancher Prime\
**Created:** [May 31, 2019, 6:53am UTC](https://forums.suse.com/t/certificate-renewal/14424 "2019-05-31T06:53:21Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![GW18](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/gw18/32/5264_2.png) [@GW18](https://forums.suse.com/u/GW18)\
**Post date:** [May 31, 2019, 6:53am UTC](https://forums.suse.com/t/certificate-renewal/14424/1 "2019-05-31T06:53:21Z")

</div>

Hi,

Are the following steps to renew a private CA certificate (GeoTrust) for Rancher HA (v2.2.3) correct?

1. Load balancer (Nginx): replace certificate with the new one

2. Rancher cluster:  
kubectl -n cattle-system delete secret tls-rancher-ingress  
kubectl -n cattle-system create secret tls tls-rancher-ingress --cert=tls.crt --key=tls.key (tls.crt is chained)

3. For every K8s cluster

- Upload and replace the certificate in Rancher UI used in projects with the new one
- Rotate certificate for all services

Thanks!