// Module included in the following assemblies:
//
// assembly-security.adoc

[id='renewing-your-own-ca-certificates-{context}']
= Renewing your own CA certificates

This procedure describes how to renew CA certificates and keys you installed yourself, instead of using the certificates generated by the Cluster Operator.

If you are using your own certificates, the Cluster Operator will not renew them automatically.
Therefore, it is important that you follow this procedure during the renewal period of the certificate in order to replace CA certificates that will soon expire.

The procedure describes the renewal of CA certificates in PEM format.
You can also use certificates in PKCS #12 format.

.Prerequisites

* The Cluster Operator is running.
* xref:installing-your-own-ca-certificates-{context}[Your own CA certificates and private keys are installed].
* You have new cluster and clients X.509 certificates and keys in PEM format.

These could be generated using an `openssl` command, such as:

[source,shell,subs="+quotes"]
openssl req -x509 -new -days _NUMBER-OF-DAYS-VALID_ --nodes -out ca.crt -keyout ca.key

.Procedure

. Check the details of the current CA certificates in the `Secret`:
+
[source,shell,subs="+quotes"]
kubectl describe secret _CA-CERTIFICATE-SECRET_
+
_CA-CERTIFICATE-SECRET_ is the name of the `Secret`, which is `_KAFKA-CLUSTER-NAME_-cluster-ca-cert` for the cluster CA certificate and `_KAFKA-CLUSTER-NAME_-clients-ca-cert` for the clients CA certificate.

. Create a directory to contain the existing CA certificates in the secret.
+
[source,shell,subs="+quotes"]
----
mkdir new-ca-cert-secret
cd new-ca-cert-secret
----

. Fetch the secret for each CA certificate you wish to renew:
+
[source,shell,subs="+quotes"]
kubectl get secret _CA-CERTIFICATE-SECRET_ -o 'jsonpath={.data._CA-CERTIFICATE_}' | base64 -d > _CA-CERTIFICATE_
+
Replace _CA-CERTIFICATE_ with the name of each CA certificate.

. Rename the old `ca.crt` file as `ca-__DATE__.crt`,
where _DATE_ is the certificate expiry date in the format _YEAR-MONTH-DAYTHOUR-MINUTE-SECONDZ_.
+
For example `ca-2018-09-27T17-32-00Z.crt`.
+
[source,shell,subs="+quotes"]
mv ca.crt ca-$(date -u -d$(openssl x509 -enddate -noout -in ca.crt | sed 's/.*=//') +'%Y-%m-%dT%H-%M-%SZ').crt

. Copy your new CA certificate into the directory, naming it `ca.crt`:
+
[source,shell,subs="+quotes"]
cp _PATH-TO-NEW-CERTIFICATE_ ca.crt

. Put your CA certificate in the corresponding `Secret`.
+
.. Delete the existing secret:
+
[source,shell,subs="+quotes"]
kubectl delete secret _CA-CERTIFICATE-SECRET_
+
_CA-CERTIFICATE-SECRET_ is the name of the `Secret`, as returned in the first step.
+
Ignore any "Not Exists" errors.

.. Recreate the secret:
+
[source,shell,subs="+quotes"]
kubectl create secret generic _CA-CERTIFICATE-SECRET_ --from-file=.

. Delete the directory you created:
+
[source,shell,subs="+quotes"]
----
cd ..
rm -r new-ca-cert-secret
----

. Put your CA key in the corresponding `Secret`.

.. Delete the existing secret:
+
[source,shell,subs="+quotes"]
kubectl delete secret _CA-KEY-SECRET_
+
_CA-KEY-SECRET_ is the name of CA key, which is `_KAFKA-CLUSTER-NAME_-cluster-ca` for the cluster CA key and `_KAFKA-CLUSTER-NAME_-clients-ca` for the clients CA key.

.. Recreate the secret with the new CA key:
+
[source,shell,subs="+quotes"]
kubectl create secret generic _CA-KEY-SECRET_ --from-file=ca.key=_CA-KEY-SECRET-FILENAME_

. Label the secrets with the labels `strimzi.io/kind=Kafka` and `strimzi.io/cluster=_KAFKA-CLUSTER-NAME_`:
+
[source,shell,subs="+quotes"]
----
kubectl label secret _CA-CERTIFICATE-SECRET_ strimzi.io/kind=Kafka strimzi.io/cluster=_KAFKA-CLUSTER-NAME_
kubectl label secret _CA-KEY-SECRET_ strimzi.io/kind=Kafka strimzi.io/cluster=_KAFKA-CLUSTER-NAME_
----
