Files
rancher-docs/getting-started/installation-and-upgrade/resources/update-rancher-certificate.html
T

26 lines
71 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-getting-started/installation-and-upgrade/resources/update-rancher-certificate">
<head>
<meta charset="UTF-8">
<meta name="generator" content="Docusaurus v2.3.1">
<title data-rh="true">Updating the Rancher Certificate | Rancher</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/update-rancher-certificate"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Updating the Rancher Certificate | Rancher"><meta data-rh="true" name="description" content="Updating a Private CA Certificate"><meta data-rh="true" property="og:description" content="Updating a Private CA Certificate"><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/update-rancher-certificate" hreflang="en"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/zh/getting-started/installation-and-upgrade/resources/update-rancher-certificate" hreflang="zh"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/update-rancher-certificate" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link data-rh="true" rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/update-rancher-certificate"><link rel="preconnect" href="https://www.googletagmanager.com">
<script>window.dataLayer=window.dataLayer||[]</script>
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
<link rel="search" type="application/opensearchdescription+xml" title="Rancher" href="/opensearch.xml">
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.efd70281.css">
<link rel="preload" href="/assets/js/runtime~main.5e8050ed.js" as="script">
<link rel="preload" href="/assets/js/main.7c8ccb50.js" as="script">
</head>
<body class="navigation-with-keyboard">
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">Latest</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/getting-started/installation-and-upgrade/resources/update-rancher-certificate">Latest</a></li><li><a class="dropdown__link" href="/v2.7/getting-started/installation-and-upgrade/resources/update-rancher-certificate">v2.7</a></li><li><a class="dropdown__link" href="/v2.6/getting-started/installation-and-upgrade/resources/update-rancher-certificate">v2.6</a></li><li><a class="dropdown__link" href="/v2.5/getting-started/installation-and-upgrade/resources/update-rancher-certificate">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4/getting-started/installation-and-upgrade/resources/update-rancher-certificate">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/getting-started/installation-and-upgrade/resources/update-rancher-certificate" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/getting-started/installation-and-upgrade/resources/update-rancher-certificate" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/">What is Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/getting-started/overview">Getting Started</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/overview">Overview</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/quick-start-guides">Quick Start Guides</a><button aria-label="Toggle the collapsible sidebar category &#x27;Quick Start Guides&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/installation-and-upgrade">Installation and Upgrade</a><button aria-label="Toggle the collapsible sidebar category &#x27;Installation and Upgrade&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/installation-requirements">Installation Requirements</a><button aria-label="Toggle the collapsible sidebar category &#x27;Installation Requirements&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/installation-references">Installation References</a><button aria-label="Toggle the collapsible sidebar category &#x27;Installation References&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster">Install/Upgrade on a Kubernetes Cluster</a><button aria-label="Toggle the collapsible sidebar category &#x27;Install/Upgrade on a Kubernetes Cluster&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/other-installation-methods">Other Installation Methods</a><button aria-label="Toggle the collapsible sidebar category &#x27;Other Installation Methods&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/resources">Resources</a><button aria-label="Toggle the collapsible sidebar category &#x27;Resources&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/choose-a-rancher-version">Choosing a Rancher Version</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/helm-version-requirements">Helm Version Requirements</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/add-tls-secrets">Adding TLS Secrets</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/custom-ca-root-certificates">About Custom CA Root Certificates</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/upgrade-cert-manager">Upgrading Cert-Manager</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/getting-started/installation-and-upgrade/resources/update-rancher-certificate">Updating the Rancher Certificate</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/bootstrap-password">Bootstrap Password</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/resources/local-system-charts">Setting up Local System Charts for Air Gapped Installations</a></li></ul></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes">Upgrading and Rolling Back Kubernetes</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher">Upgrading Kubernetes without Upgrading Rancher</a></li></ul></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/new-user-guides">How-to Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/best-practices">Reference Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/cloud-marketplace">Integrations in Rancher</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/faq/general-faq">FAQ</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/troubleshooting/general-troubleshooting">Troubleshooting</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/contribute-to-rancher">Contributing to Rancher</a></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Getting Started</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/pages-for-subheaders/installation-and-upgrade"><span itemprop="name">Installation and Upgrade</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/pages-for-subheaders/resources"><span itemprop="name">Resources</span></a><meta itemprop="position" content="3"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Updating the Rancher Certificate</span><meta itemprop="position" content="4"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: Latest</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Updating the Rancher Certificate</h1></header><h2 class="anchor anchorWithStickyNavbar_LWe7" id="updating-a-private-ca-certificate">Updating a Private CA Certificate<a href="#updating-a-private-ca-certificate" class="hash-link" aria-label="Direct link to Updating a Private CA Certificate" title="Direct link to Updating a Private CA Certificate">​</a></h2><p>Follow these steps to rotate an SSL certificate and private CA used by Rancher <a href="/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster">installed on a Kubernetes cluster</a>, or migrate to an SSL certificate signed by a private CA.</p><p>A summary of the steps is as follows:</p><ol><li>Create or update the <code>tls-rancher-ingress</code> Kubernetes secret object with the new certificate and private key.</li><li>Create or update the <code>tls-ca</code> Kubernetes secret object with the root CA certificate (only required when using a private CA).</li><li>Update the Rancher installation using the Helm CLI.</li><li>Reconfigure the Rancher agents to trust the new CA certificate.</li><li>Select Force Update of Fleet clusters to connect fleet-agent to Rancher.</li></ol><p>The details of these instructions are below.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="1-createupdate-the-certificate-secret-object">1. Create/update the certificate secret object<a href="#1-createupdate-the-certificate-secret-object" class="hash-link" aria-label="Direct link to 1. Create/update the certificate secret object" title="Direct link to 1. Create/update the certificate secret object">​</a></h3><p>First, concatenate the server certificate followed by any intermediate certificate(s) to a file named <code>tls.crt</code> and provide the corresponding certificate key in a file named <code>tls.key</code>.</p><p>Use the following command to create the <code>tls-rancher-ingress</code> secret object in the Rancher (local) management cluster:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret tls tls-rancher-ingress </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cert</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.crt </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --key</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.key</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>Alternatively, to update an existing <code>tls-rancher-ingress</code> secret:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret tls tls-rancher-ingress </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cert</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.crt </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --key</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.key </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --dry-run --save-config -o yaml </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> kubectl apply -f -</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="2-createupdate-the-ca-certificate-secret-object">2. Create/update the CA certificate secret object<a href="#2-createupdate-the-ca-certificate-secret-object" class="hash-link" aria-label="Direct link to 2. Create/update the CA certificate secret object" title="Direct link to 2. Create/update the CA certificate secret object">​</a></h3><p>If the new certificate was signed by a private CA, you will need to copy the corresponding root CA certificate into a file named <code>cacerts.pem</code> and create or update the <code>tls-ca</code> secret in the <code>cattle-system</code> namespace. If the certificate was signed by an intermediate CA, then the <code>cacerts.pem</code> must contain both the intermediate and root CA certificates (in this order).</p><p>To create the initial <code>tls-ca</code> secret:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret generic tls-ca </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --from-file</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">cacerts.pem</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>To update an existing <code>tls-ca</code> secret:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret generic tls-ca </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --from-file</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">cacerts.pem </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --dry-run --save-config -o yaml </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> kubectl apply -f -</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="3-reconfigure-the-rancher-deployment">3. Reconfigure the Rancher deployment<a href="#3-reconfigure-the-rancher-deployment" class="hash-link" aria-label="Direct link to 3. Reconfigure the Rancher deployment" title="Direct link to 3. Reconfigure the Rancher deployment">​</a></h3><p>If the certificate source remains the same (for example, <code>secret</code>), please follow the steps in Step 3a.</p><p>However, if the certificate source is changing (for example, <code>letsEncrypt</code> to <code>secret</code>), follow the steps in 3b.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="3a-redeploy-the-rancher-pods">3a. Redeploy the Rancher pods<a href="#3a-redeploy-the-rancher-pods" class="hash-link" aria-label="Direct link to 3a. Redeploy the Rancher pods" title="Direct link to 3a. Redeploy the Rancher pods">​</a></h4><p>This step is required when the certificate source remains the same, but the CA certificate is being updated.</p><p>In this scenario a redeploy of the Rancher pods is needed, this is because the <code>tls-ca</code> secret is read by the Rancher pods when starting.</p><p>The command below can be used to redeploy the Rancher pods:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl rollout restart deploy/rancher -n cattle-system</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>When the change is completed, navigate to <code>https://&lt;RANCHER_SERVER_URL&gt;/v3/settings/cacerts</code> to verify that the value matches the CA certificate written in the <code>tls-ca</code> secret earlier. The CA <code>cacerts</code> value may not update until all of the redeployed Rancher pods start.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="3b-update-the-helm-values-for-rancher">3b. Update the Helm values for Rancher<a href="#3b-update-the-helm-values-for-rancher" class="hash-link" aria-label="Direct link to 3b. Update the Helm values for Rancher" title="Direct link to 3b. Update the Helm values for Rancher">​</a></h4><p>This step is required if the certificate source is changing. If Rancher was previously configured to use the default self-signed certificate (<code>ingress.tls.source=rancher</code>) or Let&#x27;s Encrypt (<code>ingress.tls.source=letsEncrypt</code>), and is now using a certificate signed by a private CA (<code>ingress.tls.source=secret</code>).</p><p>The below steps update the Helm values for the Rancher chart, so the Rancher pods and ingress are reconfigured to use the new private CA certificate created in Step 1 &amp; 2.</p><ol><li>Adjust the values that were used during initial installation, store the current values with:<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">helm get values rancher -n cattle-system -o yaml </span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><span class="token plain"> values.yaml</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li>Retrieve the version string of the currently deployed Rancher chart to use below:<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">helm </span><span class="token function" style="color:rgb(130, 170, 255)">ls</span><span class="token plain"> -n cattle-system</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li>Update the current Helm values in the <code>values.yaml</code> file to contain:<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">ingress</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">source</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> secret</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">privateCA</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>Important:</div><div class="admonitionContent_S0QG"><p>As the certificate is signed by a private CA, it is important to ensure <a href="/getting-started/installation-and-upgrade/installation-references/helm-chart-options#common-options"><code>privateCA: true</code></a> is set in the <code>values.yaml</code> file.</p></div></div></li><li>Upgrade the Helm application instance using the <code>values.yaml</code> file and the current chart version. The version must match to prevent an upgrade of Rancher.<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> helm upgrade rancher rancher-stable/rancher </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --namespace cattle-system </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> -f values.yaml </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --version </span><span class="token operator" style="color:rgb(137, 221, 255)">&lt;</span><span class="token plain">DEPLOYED_RANCHER_VERSION</span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li></ol><p>When the change is completed, navigate to <code>https://&lt;RANCHER_SERVER_URL&gt;/v3/settings/cacerts</code> to verify that the value matches the CA certificate written in the <code>tls-ca</code> secret earlier. The CA <code>cacerts</code> value may not update until all Rancher pods start.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="4-reconfigure-rancher-agents-to-trust-the-private-ca">4. Reconfigure Rancher agents to trust the private CA<a href="#4-reconfigure-rancher-agents-to-trust-the-private-ca" class="hash-link" aria-label="Direct link to 4. Reconfigure Rancher agents to trust the private CA" title="Direct link to 4. Reconfigure Rancher agents to trust the private CA">​</a></h3><p>This section covers three methods to reconfigure Rancher agents to trust the private CA. This step is required if either of the following is true:</p><ul><li>Rancher was previously configured to use the Rancher self-signed certificate (<code>ingress.tls.source=rancher</code>) or with a Let&#x27;s Encrypt issued certificate (<code>ingress.tls.source=letsEncrypt</code>)</li><li>The certificate was signed by a different private CA</li></ul><h4 class="anchor anchorWithStickyNavbar_LWe7" id="why-is-this-step-required">Why is this step required?<a href="#why-is-this-step-required" class="hash-link" aria-label="Direct link to Why is this step required?" title="Direct link to Why is this step required?">​</a></h4><p>When Rancher is configured with a certificate signed by a private CA, the CA certificate chain is trusted by Rancher agent containers. Agents compare the checksum of the downloaded certificate against the <code>CATTLE_CA_CHECKSUM</code> environment variable. This means that, when the private CA certificate used by Rancher has changed, the environment variable <code>CATTLE_CA_CHECKSUM</code> must be updated accordingly.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="which-method-should-i-choose">Which method should I choose?<a href="#which-method-should-i-choose" class="hash-link" aria-label="Direct link to Which method should I choose?" title="Direct link to Which method should I choose?">​</a></h4><p>Method 1 is the easiest, but requires all clusters to be connected to Rancher after the certificates have been rotated. This is usually the case if the process is performed right after updating or redeploying the Rancher deployment (Step 3).</p><p>If the clusters have lost connection to Rancher but <a href="/how-to-guides/new-user-guides/manage-clusters/access-clusters/authorized-cluster-endpoint">Authorized Cluster Endpoint</a> (ACE) is enabled on all clusters, then go with method 2.</p><p>Method 3 can be used as a fallback if method 1 and 2 are not possible.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="method-1-force-a-redeploy-of-the-rancher-agents">Method 1: Force a redeploy of the Rancher agents<a href="#method-1-force-a-redeploy-of-the-rancher-agents" class="hash-link" aria-label="Direct link to Method 1: Force a redeploy of the Rancher agents" title="Direct link to Method 1: Force a redeploy of the Rancher agents">​</a></h4><p>For each downstream cluster run the following command using the Kubeconfig file of the Rancher (local) management cluster.</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl annotate clusters.management.cattle.io </span><span class="token operator" style="color:rgb(137, 221, 255)">&lt;</span><span class="token plain">CLUSTER_ID</span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><span class="token plain"> io.cattle.agent.force.deploy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</div><div class="admonitionContent_S0QG"><p>Locate the cluster ID (c-xxxxx) for the downstream cluster, this can be seen in the browser URL bar when viewing the cluster in the Rancher UI, under Cluster Management.</p></div></div><p>This command will cause the agent manifest to be reapplied with the checksum of the new certificate.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="method-2-manually-update-the-checksum-environment-variable">Method 2: Manually update the checksum environment variable<a href="#method-2-manually-update-the-checksum-environment-variable" class="hash-link" aria-label="Direct link to Method 2: Manually update the checksum environment variable" title="Direct link to Method 2: Manually update the checksum environment variable">​</a></h4><p>Manually patch the agent Kubernetes objects by updating the <code>CATTLE_CA_CHECKSUM</code> environment variable to the value matching the checksum of the new CA certificate. Generate the new checksum value like so:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token function" style="color:rgb(130, 170, 255)">curl</span><span class="token plain"> -k -s -fL </span><span class="token operator" style="color:rgb(137, 221, 255)">&lt;</span><span class="token plain">RANCHER_SERVER_URL</span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><span class="token plain">/v3/settings/cacerts </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> jq -r .value </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> sha256sum </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> </span><span class="token function" style="color:rgb(130, 170, 255)">awk</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">&#x27;{print $1}&#x27;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>Using a Kubeconfig for each downstream cluster update the environment variable for the two agent deployments. If the <a href="/how-to-guides/new-user-guides/manage-clusters/access-clusters/authorized-cluster-endpoint">ACE</a> is enabled for the cluster, <a href="/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig#authenticating-directly-with-a-downstream-cluster">the kubectl context can be adjusted</a> to connect directly to the downstream cluster.</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl edit -n cattle-system ds/cattle-node-agent</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl edit -n cattle-system deployment/cattle-cluster-agent</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h4 class="anchor anchorWithStickyNavbar_LWe7" id="method-3-manually-redeploy-the-rancher-agents">Method 3: Manually redeploy the Rancher agents<a href="#method-3-manually-redeploy-the-rancher-agents" class="hash-link" aria-label="Direct link to Method 3: Manually redeploy the Rancher agents" title="Direct link to Method 3: Manually redeploy the Rancher agents">​</a></h4><p>With this method the Rancher agents are reapplied by running a set of commands on a control plane node of each downstream cluster.</p><p>Repeat the below steps for each downstream cluster:</p><ol><li><p>Retrieve the agent registration kubectl command:</p><ol><li>Locate the cluster ID (c-xxxxx) for the downstream cluster, this can be seen in the URL when viewing the cluster in the Rancher UI under Cluster Management</li><li>Add the Rancher server URL and cluster ID to the following URL: <code>https://&lt;RANCHER_SERVER_URL&gt;/v3/clusterregistrationtokens?clusterId=&lt;CLUSTER_ID&gt;</code></li><li>Copy the command from the <code>insecureCommand</code> field, this command is used because a private CA is un use</li></ol></li><li><p>Run the kubectl command from the previous step using a kubeconfig for the downstream cluster with one of the following methods:</p><ol><li>If the <a href="/how-to-guides/new-user-guides/manage-clusters/access-clusters/authorized-cluster-endpoint">ACE</a> is enabled for the cluster, <a href="/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig#authenticating-directly-with-a-downstream-cluster">the context can be adjusted</a> to connect directly to the downstream cluster</li><li>Alternatively, SSH into the control plane node:<ul><li>RKE: Use the <a href="https://github.com/rancherlabs/support-tools/tree/master/how-to-retrieve-kubeconfig-from-custom-cluster" target="_blank" rel="noopener noreferrer">steps in the document here</a> to generate a kubeconfig</li><li>RKE2/K3s: Use the kubeconfig populated during installation</li></ul></li></ol></li></ol><h3 class="anchor anchorWithStickyNavbar_LWe7" id="5-force-update-fleet-clusters-to-reconnect-the-fleet-agent-to-rancher">5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher<a href="#5-force-update-fleet-clusters-to-reconnect-the-fleet-agent-to-rancher" class="hash-link" aria-label="Direct link to 5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher" title="Direct link to 5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher">​</a></h3><p>Select &#x27;Force Update&#x27; for the clusters within the <a href="/how-to-guides/new-user-guides/deploy-apps-across-clusters/fleet#accessing-fleet-in-the-rancher-ui">Continuous Delivery</a> view of the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="why-is-this-step-required-1">Why is this step required?<a href="#why-is-this-step-required-1" class="hash-link" aria-label="Direct link to Why is this step required?" title="Direct link to Why is this step required?">​</a></h4><p>Fleet agents in Rancher managed clusters store a kubeconfig that is used to connect to Rancher. The kubeconfig contains a <code>certificate-authority-data</code> field containing the CA for the certificate used by Rancher. When changing the CA, this block needs to be updated to allow the fleet-agent to trust the certificate used by Rancher.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="updating-from-a-private-ca-certificate-to-a-public-ca-certificate">Updating from a Private CA Certificate to a Public CA Certificate<a href="#updating-from-a-private-ca-certificate-to-a-public-ca-certificate" class="hash-link" aria-label="Direct link to Updating from a Private CA Certificate to a Public CA Certificate" title="Direct link to Updating from a Private CA Certificate to a Public CA Certificate">​</a></h2><p>Follow these steps to perform the opposite procedure as shown above, to change from a certificate issued by a private CA, to a public or self-signed CA.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="1-createupdate-the-certificate-secret-object-1">1. Create/update the certificate secret object<a href="#1-createupdate-the-certificate-secret-object-1" class="hash-link" aria-label="Direct link to 1. Create/update the certificate secret object" title="Direct link to 1. Create/update the certificate secret object">​</a></h3><p>First, concatenate the server certificate followed by any intermediate certificate(s) to a file named <code>tls.crt</code> and provide the corresponding certificate key in a file named <code>tls.key</code>.</p><p>Use the following command to create the <code>tls-rancher-ingress</code> secret object in the Rancher (local) management cluster:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret tls tls-rancher-ingress </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cert</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.crt </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --key</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.key</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>Alternatively, to update an existing <code>tls-rancher-ingress</code> secret:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret tls tls-rancher-ingress </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cert</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.crt </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --key</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">tls.key </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --dry-run --save-config -o yaml </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> kubectl apply -f -</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="2-delete-the-ca-certificate-secret-object">2. Delete the CA certificate secret object<a href="#2-delete-the-ca-certificate-secret-object" class="hash-link" aria-label="Direct link to 2. Delete the CA certificate secret object" title="Direct link to 2. Delete the CA certificate secret object">​</a></h3><p>You will delete the <code>tls-ca</code> secret in the <code>cattle-system</code> namespace as it is no longer needed. You may also optionally save a copy of the <code>tls-ca</code> secret if desired.</p><p>To save the existing <code>tls-ca</code> secret:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system get secret tls-ca -o yaml </span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><span class="token plain"> tls-ca.yaml</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>To delete the existing <code>tls-ca</code> secret:</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system delete secret tls-ca</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="3-reconfigure-the-rancher-deployment-1">3. Reconfigure the Rancher deployment<a href="#3-reconfigure-the-rancher-deployment-1" class="hash-link" aria-label="Direct link to 3. Reconfigure the Rancher deployment" title="Direct link to 3. Reconfigure the Rancher deployment">​</a></h3><p>This step is required if the certificate source is changing. In this scenario it&#x27;s likely only changing because Rancher was previously configured to use the default self-signed certificate (<code>ingress.tls.source=rancher</code>).</p><p>The below steps update the Helm values for the Rancher chart, so the Rancher pods and ingress are reconfigured to use the new certificate created in Step 1.</p><ol><li>Adjust the values that were used during initial installation, store the current values with:<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">helm get values rancher -n cattle-system -o yaml </span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><span class="token plain"> values.yaml</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li>Also get the version string of the currently deployed Rancher chart:<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">helm </span><span class="token function" style="color:rgb(130, 170, 255)">ls</span><span class="token plain"> -n cattle-system</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li>Update the current Helm values in the <code>values.yaml</code> file:<ol><li>As a private CA is no longer being used, remove the <code>privateCA: true</code> field, or set this to <code>false</code></li><li>Adjust the <code>ingress.tls.source</code> field as necessary. Please <a href="/getting-started/installation-and-upgrade/installation-references/helm-chart-options#common-options">refer to the chart options</a> for more details. Here are some examples:<ol><li>If using a public CA continue with a value of: <code>secret</code></li><li>If using Let&#x27;s Encrypt update the value to: <code>letsEncrypt</code></li></ol></li></ol></li><li>Update the Helm values for the Rancher chart using the <code>values.yaml</code> file, and the current chart version to prevent an upgrade:<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> helm upgrade rancher rancher-stable/rancher </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --namespace cattle-system </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> -f values.yaml </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --version </span><span class="token operator" style="color:rgb(137, 221, 255)">&lt;</span><span class="token plain">DEPLOYED_RANCHER_VERSION</span><span class="token operator" style="color:rgb(137, 221, 255)">&gt;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li></ol><h3 class="anchor anchorWithStickyNavbar_LWe7" id="4-reconfigure-rancher-agents-for-the-non-privatecommon-certificate">4. Reconfigure Rancher agents for the non-private/common certificate<a href="#4-reconfigure-rancher-agents-for-the-non-privatecommon-certificate" class="hash-link" aria-label="Direct link to 4. Reconfigure Rancher agents for the non-private/common certificate" title="Direct link to 4. Reconfigure Rancher agents for the non-private/common certificate">​</a></h3><p>As a private CA is no longer being used, the <code>CATTLE_CA_CHECKSUM</code> environment variable on the downstream cluster agents should be removed or set to &quot;&quot; (an empty string).</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="5-force-update-fleet-clusters-to-reconnect-the-fleet-agent-to-rancher-1">5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher<a href="#5-force-update-fleet-clusters-to-reconnect-the-fleet-agent-to-rancher-1" class="hash-link" aria-label="Direct link to 5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher" title="Direct link to 5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher">​</a></h3><p>Select &#x27;Force Update&#x27; for the clusters within the <a href="/how-to-guides/new-user-guides/deploy-apps-across-clusters/fleet#accessing-fleet-in-the-rancher-ui">Continuous Delivery</a> view of the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="why-is-this-step-required-2">Why is this step required?<a href="#why-is-this-step-required-2" class="hash-link" aria-label="Direct link to Why is this step required?" title="Direct link to Why is this step required?">​</a></h4><p>Fleet agents in Rancher managed clusters store a kubeconfig that is used to connect to Rancher. The kubeconfig contains a <code>certificate-authority-data</code> field containing the CA for the certificate used by Rancher. When changing the CA, this block needs to be updated to allow the fleet-agent to trust the certificate used by Rancher.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/getting-started/installation-and-upgrade/resources/update-rancher-certificate.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2023-08-07T16:30:55.000Z">Aug 7, 2023</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/getting-started/installation-and-upgrade/resources/upgrade-cert-manager"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Upgrading Cert-Manager</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/getting-started/installation-and-upgrade/resources/bootstrap-password"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Bootstrap Password</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#updating-a-private-ca-certificate" class="table-of-contents__link toc-highlight">Updating a Private CA Certificate</a><ul><li><a href="#1-createupdate-the-certificate-secret-object" class="table-of-contents__link toc-highlight">1. Create/update the certificate secret object</a></li><li><a href="#2-createupdate-the-ca-certificate-secret-object" class="table-of-contents__link toc-highlight">2. Create/update the CA certificate secret object</a></li><li><a href="#3-reconfigure-the-rancher-deployment" class="table-of-contents__link toc-highlight">3. Reconfigure the Rancher deployment</a></li><li><a href="#4-reconfigure-rancher-agents-to-trust-the-private-ca" class="table-of-contents__link toc-highlight">4. Reconfigure Rancher agents to trust the private CA</a></li><li><a href="#5-force-update-fleet-clusters-to-reconnect-the-fleet-agent-to-rancher" class="table-of-contents__link toc-highlight">5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher</a></li></ul></li><li><a href="#updating-from-a-private-ca-certificate-to-a-public-ca-certificate" class="table-of-contents__link toc-highlight">Updating from a Private CA Certificate to a Public CA Certificate</a><ul><li><a href="#1-createupdate-the-certificate-secret-object-1" class="table-of-contents__link toc-highlight">1. Create/update the certificate secret object</a></li><li><a href="#2-delete-the-ca-certificate-secret-object" class="table-of-contents__link toc-highlight">2. Delete the CA certificate secret object</a></li><li><a href="#3-reconfigure-the-rancher-deployment-1" class="table-of-contents__link toc-highlight">3. Reconfigure the Rancher deployment</a></li><li><a href="#4-reconfigure-rancher-agents-for-the-non-privatecommon-certificate" class="table-of-contents__link toc-highlight">4. Reconfigure Rancher agents for the non-private/common certificate</a></li><li><a href="#5-force-update-fleet-clusters-to-reconnect-the-fleet-agent-to-rancher-1" class="table-of-contents__link toc-highlight">5. Force Update Fleet clusters to reconnect the fleet-agent to Rancher</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/assets/js/runtime~main.5e8050ed.js"></script>
<script src="/assets/js/main.7c8ccb50.js"></script>
</body>
</html>