This is a cache of https://docs.openshift.com/container-platform/4.4/cnv/cnv_node_maintenance/cnv-refresh-certificates.html. It is a snapshot of the page at 2024-11-23T01:46:55.535+0000.
Manually refreshing TLS <strong>certificate</strong>s - Node maintenance | Container-native virtualization | OpenShift Container Platform 4.4
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Manually refreshing TLS certificates

The TLS certificates for container-native virtualization components are created at the time of installation and are valid for one year. You must manually refresh these certificates before they expire.

Refreshing TLS certificates

To refresh the TLS certificates for container-native virtualization, download and run the rotate-certs script. This script is available from the kubevirt/hyperconverged-cluster-operator repository on GitHub.

When refreshing the certificates, the following operations are impacted:

  • Migrations are canceled

  • Image uploads are canceled

  • VNC and console connections are closed
Prerequisites

  • Ensure that you are logged in to the cluster as a user with cluster-admin privileges. The script uses your active session to the cluster to refresh certificates in the openshift-cnv namespace.

Procedure

  1. Download the rotate-certs.sh script from GitHub:

    $ curl -O https://raw.githubusercontent.com/kubevirt/hyperconverged-cluster-operator/master/tools/rotate-certs.sh

  2. Ensure the script is executable:

    $ chmod +x rotate-certs.sh

  3. Run the script:

    $ ./rotate-certs.sh -n openshift-cnv

The TLS certificates are refreshed and valid for one year.