Breadcrumbs

Extend TLS/SSL Certificates Expiry for RKE2 ( existing deployments )

This procedure requires a Downtime involved. Proceed with outage planned in advance.

If you already have nodes running with 365-day certificates and want to update them to the extended lifetime:

  1. Add CATTLE_NEW_SIGNED_CERT_EXPIRATION_DAYS=3650 to /etc/default/rke2-server.

    1. echo "CATTLE_NEW_SIGNED_CERT_EXPIRATION_DAYS=3650" >> /etc/default/rke2-server

  2. Stop the service: systemctl stop rke2-server.

  3. Rotate certificates manually: rke2 certificate rotate.

  4. Start the service: systemctl start rke2-server.

  5. Validate the certificates regenerated have an extended expiry rke2 certificate check --output table


Official Reference