:_mod-docs-content-type: PROCEDURE

// Module included in the following assemblies:
//
// assembly-security.adoc

[id='proc-renewing-ca-certs-manually-{context}']

= Manually renewing Cluster Operator-managed CA certificates

[role="_abstract"]
Cluster and clients CA certificates generated by the Cluster Operator auto-renew at the start of their respective certificate renewal periods.
However, you can use the `strimzi.io/force-renew` annotation to manually renew one or both of these certificates before the certificate renewal period starts.
You might do this for security reasons, or if you have xref:con-certificate-renewal-str[changed the renewal or validity periods for the certificates].

A renewed certificate uses the same private key as the old certificate.

NOTE: If you are using your own CA certificates, the `force-renew` annotation cannot be used.
Instead, follow the procedure for xref:renewing-your-own-ca-certificates-{context}[renewing your own CA certificates].

.Prerequisites

* xref:deploying-cluster-operator-str[The Cluster Operator must be deployed.]
* A Kafka cluster in which CA certificates and private keys are installed.
* The OpenSSL TLS management tool to check the period of validity for CA certificates.

In this procedure, we use a Kafka cluster named `my-cluster` within the `my-project` namespace.

.Procedure

. Apply the `strimzi.io/force-renew` annotation to the secret that contains the CA certificate that you want to renew.
+
.Renewing the Cluster CA secret
[source,shell]
----
kubectl annotate secret my-cluster-cluster-ca-cert -n my-project strimzi.io/force-renew="true"

----
+
.Renewing the Clients CA secret
[source,shell]
----
kubectl annotate secret my-cluster-clients-ca-cert -n my-project strimzi.io/force-renew="true"
----

. At the next reconciliation, the Cluster Operator generates new certificates. 
+
If maintenance time windows are configured, the Cluster Operator generates the new CA certificate at the first reconciliation within the next maintenance time window.

. Check the period of validity for the new CA certificates.
+
.Checking the period of validity for the new cluster CA certificate
[source,shell]
----
kubectl get secret my-cluster-cluster-ca-cert -n my-project -o=jsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -noout -dates
----
+
.Checking the period of validity for the new clients CA certificate
[source,shell]
----
kubectl get secret my-cluster-clients-ca-cert -n my-project -o=jsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -noout -dates
----
+
The command returns a `notBefore` and `notAfter` date, which is the valid start and end date for the CA certificate.

. Update client configurations to trust the new cluster CA certificate.
+
See:
+
--
* xref:configuring-internal-clients-to-trust-cluster-ca-str[]
* xref:configuring-external-clients-to-trust-cluster-ca-str[]
--
