// Module included in the following assemblies:
//
// assembly-security.adoc

[id='renewing-your-own-ca-certificates-{context}']
= Renewing your own CA certificates

[role="_abstract"]
If you are using your own CA certificates, you need to renew them manually.
The Cluster Operator will not renew them automatically.
Renew the CA certificates in the renewal period before they expire.

Perform the steps in this procedure when you are renewing CA certificates and continuing with the same private key.
If you are renewing your own CA certificates _and_ private keys, see xref:proc-replacing-your-own-private-keys-{context}[]. 

The procedure describes the renewal of CA certificates in PEM format.

.Prerequisites

* The Cluster Operator is running.
* You have new cluster or clients X.509 certificates in PEM format.

.Procedure

. Update the `Secret` for the CA certificate.
+
Edit the existing secret to add the new CA certificate and update the certificate generation annotation value.
+
[source,shell,subs="+quotes"]
kubectl edit secret _<ca_certificate_secret_name>_
+
_<ca_certificate_secret_name>_ is the name of the `Secret`, which is `_<kafka_cluster_name>_-cluster-ca-cert` for the cluster CA certificate and `_<kafka_cluster_name>_-clients-ca-cert` for the clients CA certificate.
+
The following example shows a secret for a cluster CA certificate that's associated with a Kafka cluster named `my-cluster`.
+
.Example secret configuration for a cluster CA certificate
[source,yaml,subs=attributes+]
----
apiVersion: v1
kind: Secret
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0F... <1>
metadata:
  annotations:
    strimzi.io/ca-cert-generation: "0" <2>
  labels:
    strimzi.io/cluster: my-cluster
    strimzi.io/kind: Kafka
  name: my-cluster-cluster-ca-cert
  #...
type: Opaque
----
<1> Current base64-encoded CA certificate
<2> Current CA certificate generation annotation value

. Encode your new CA certificate into base64.
+
[source,shell,subs="+quotes"]
cat _<path_to_new_certificate>_ | base64

. Update the CA certificate.
+
Copy the base64-encoded CA certificate from the previous step as the value for the `ca.crt` property under `data`.
+
. Increase the value of the CA certificate generation annotation.
+
Update the `strimzi.io/ca-cert-generation` annotation with a higher incremental value.
For example, change `strimzi.io/ca-cert-generation=0` to `strimzi.io/ca-cert-generation=1`.
If the `Secret` is missing the annotation, the value is treated as `0`, so add the annotation with a value of `1`.
+
When Strimzi generates certificates, the certificate generation annotation is automatically incremented by the Cluster Operator.
For your own CA certificates, set the annotations with a higher incremental value.
The annotation needs a higher value than the one from the current secret so that the Cluster Operator can roll the pods and update the certificates.
The `strimzi.io/ca-cert-generation` has to be incremented on each CA certificate renewal.

. Save the secret with the new CA certificate and certificate generation annotation value.
+
.Example secret configuration updated with a new CA certificate
[source,yaml,subs=attributes+]
----
apiVersion: v1
kind: Secret
data:
  ca.crt: GCa6LS3RTHeKFiFDGBOUDYFAZ0F... <1>
metadata:
  annotations:
    strimzi.io/ca-cert-generation: "1" <2>
  labels:
    strimzi.io/cluster: my-cluster
    strimzi.io/kind: Kafka
  name: my-cluster-cluster-ca-cert
  #...
type: Opaque
----
<1> New base64-encoded CA certificate
<2> New CA certificate generation annotation value

On the next reconciliation, the Cluster Operator performs a rolling update of ZooKeeper, Kafka, and other components to trust the new CA certificate.

If maintenance time windows are configured, the Cluster Operator will roll the pods at the first reconciliation within the next maintenance time window.
