# Rancher CA certs

**URL:** https://forums.suse.com/t/rancher-ca-certs/45611
**Category:** General
**Created:** [June 16, 2025, 1:44pm UTC](https://forums.suse.com/t/rancher-ca-certs/45611 "2025-06-16T13:44:20Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![patches\_05](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@patches\_05](https://forums.suse.com/u/patches_05)
#### Post date: [June 16, 2025, 1:44pm UTC](https://forums.suse.com/t/rancher-ca-certs/45611/1 "2025-06-16T13:44:20Z")

</div>

I’m using RKE2 and installed the chart using the following command:

```auto
helm upgrade -i rancher rancher-chart \
        --namespace cattle-system \
        --set hostname='rancher.test.net' \
        --set bootstrapPassword=$boot_pass \
        --set privateCA=true \
        --set ingress.tls.source=secret \
        --set ingress.tls.ingressClassName=nginx

```

To create secrets, I followed the instructions in this [guide](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/add-tls-secrets)  
However, when I tried to add a node, I received the following error:

```auto
[INFO] Value from https://rancher.test.net/cacerts is an x509 certificate
[ERROR] Configured cacerts checksum (1382944946dbe8c6faf7d0bd6d33d6593f3416579e75efa6ad852c2e24453016) does not match given --ca-checksum (543edb437be8e3b68c60bb09fc27bde24f26ce62bec2e44e182681c2df6ed06b)
[ERROR] Please check if the correct certificate is configured at https://rancher.test.net/cacerts

```

When I navigate to` https://rancher.test.net/cacerts`, it shows the value from the `tls-rancher-internal-ca` secret.  
Manually updating the `tls-rancher-internal-ca` secret resolves the issue if you’re using a private CA. ([https://github.com/rancher/rancher/issues/36632#issuecomment-1633600724](https://github.com/rancher/rancher/issues/36632#issuecomment-1633600724))  
Any thoughts? Did I miss something?

Rancher chart version: 2.11.2  
RKE2 version: v1.31.9+rke2r1