# Rotate self signed certificate

**URL:** <https://forums.suse.com/t/rotate-self-signed-certificate/17934>\
**Category:** SUSE Rancher Prime\
**Created:** [July 10, 2020, 8:31am UTC](https://forums.suse.com/t/rotate-self-signed-certificate/17934 "2020-07-10T08:31:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jehutyy](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jehutyy](https://forums.suse.com/u/jehutyy)\
**Post date:** [July 10, 2020, 8:31am UTC](https://forums.suse.com/t/rotate-self-signed-certificate/17934/1 "2020-07-10T08:31:36Z")

</div>

Hi everyone,

I stumbled upon an issue with certificate rotation.

We’ve deployed rancher on kubernetes with rke and self signed certificate. Our certificate expired Wednesday at 5 pm which leads to kubectl being unable to contact kubernetes cluster (X509 certificate expired or not yet valid).

As rancher ui was still available I tried to rotate certificate only to see that I would have to do it through rke and not the ui since it is an imported cluster(if I understand correctly).

So I tried to use rke like that `rke cert rotate` without success. It ran correctly but I still could not use kubectl.

I tried `rke cert rotate --rotate-ca` which appears to run correctly as well but kubectl was still unable to contact cluster. More on that, it triggered an error on rancher ui telling a CA certificate mismatch and thus I was unable to log on rancher ui.

Before that I also tried to update tls-rancher-ingress and tls-ca and upgrade rancher with `helm upgrade` but that didn’t work either.

I finally decided to reinstall the cluster because nothing critical was running but in the case I could not reinstall the cluster what should I have done to generate new certificate and tell rancher to use it ?

## Setup :

rancher 2.3.7  
rke 1.0.8 (iirc)  
kubernetes 1.17 for the imported cluster deployed with rke