// Module included in the following assemblies:
//
// assembly-security.adoc

[id='renewing-your-own-ca-certificates-{context}']
= Renewing your own CA certificates

This procedure describes how to renew CA certificates and keys that you previously installed.
You need to follow this procedure during the renewal period in order to replace CA certificates which will soon expire.

You can use this procedure to install your own cluster or client CA certificates.

The procedure describes renewal of CA certificates in PEM format.
You can also use certificates in PKCS #12 format.

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster in which you previously installed your own CA certificates and private keys.
* New cluster and clients X.509 certificates and keys in PEM format.

These could be generated using an `openssl` command, such as:

[source,shell,subs="+quotes"]
openssl req -x509 -new -days _NUMBER-OF-DAYS-VALID_ --nodes -out ca.crt -keyout ca.key

.Procedure

. Check the details of the current CA certificates in the `Secret`:
+
[source,shell,subs="+quotes"]
kubectl describe secret _CA-CERTIFICATE-SECRET_
+
_CA-CERTIFICATE-SECRET_ is the name of the `Secret`, which is `_KAFKA-CLUSTER-NAME_-cluster-ca-cert` for the cluster CA certificate and `_KAFKA-CLUSTER-NAME_-clients-ca-cert` for the clients CA certificate.

. Create a directory to contain the existing CA certificates in the secret.
+
[source,shell,subs="+quotes"]
----
mkdir new-ca-cert-secret
cd new-ca-cert-secret
----

. Fetch the secret for each CA certificate you wish to renew:
+
[source,shell,subs="+quotes"]
kubectl get secret _CA-CERTIFICATE-SECRET_ -o 'jsonpath={.data._CA-CERTIFICATE_}' | base64 -d > _CA-CERTIFICATE_
+
Replace _CA-CERTIFICATE_ with the name of each CA certificate.

. Rename the old `ca.crt` file as `ca-__DATE__.crt`,
where _DATE_ is the certificate expiry date in the format _YEAR-MONTH-DAYTHOUR-MINUTE-SECONDZ_.
+
For example `ca-2018-09-27T17-32-00Z.crt`.
+
[source,shell,subs="+quotes"]
mv ca.crt ca-$(date -u -d$(openssl x509 -enddate -noout -in ca.crt | sed 's/.*=//') +'%Y-%m-%dT%H-%M-%SZ').crt

. Copy your new CA certificate into the directory, naming it `ca.crt`:
+
[source,shell,subs="+quotes"]
cp _PATH-TO-NEW-CERTIFICATE_ ca.crt

. Put your CA certificate in the corresponding `Secret`.
+
.. Delete the existing secret:
+
[source,shell,subs="+quotes"]
kubectl delete secret _CA-CERTIFICATE-SECRET_
+
_CA-CERTIFICATE-SECRET_ is the name of the `Secret`, as returned in the first step.
+
Ignore any "Not Exists" errors.

.. Recreate the secret:
+
[source,shell,subs="+quotes"]
kubectl create secret generic _CA-CERTIFICATE-SECRET_ --from-file=.

. Delete the directory you created:
+
[source,shell,subs="+quotes"]
----
cd ..
rm -r new-ca-cert-secret
----

. Put your CA key in the corresponding `Secret`.

.. Delete the existing secret:
+
[source,shell,subs="+quotes"]
kubectl delete secret _CA-KEY-SECRET_
+
_CA-KEY-SECRET_ is the name of CA key, which is `_KAFKA-CLUSTER-NAME_-cluster-ca` for the cluster CA key and `_KAFKA-CLUSTER-NAME_-clients-ca` for the clients CA key.

.. Recreate the secret with the new CA key:
+
[source,shell,subs="+quotes"]
kubectl create secret generic _CA-KEY-SECRET_ --from-file=ca.key=_CA-KEY-SECRET-FILENAME_

. Label the secrets with the labels `strimzi.io/kind=Kafka` and `strimzi.io/cluster=_KAFKA-CLUSTER-NAME_`:
+
[source,shell,subs="+quotes"]
----
kubectl label secret _CA-CERTIFICATE-SECRET_ strimzi.io/kind=Kafka strimzi.io/cluster=_KAFKA-CLUSTER-NAME_
kubectl label secret _CA-KEY-SECRET_ strimzi.io/kind=Kafka strimzi.io/cluster=_KAFKA-CLUSTER-NAME_
----
