// Module included in the following assemblies:
//
// assembly-security.adoc

[id='renewing-your-own-ca-certificates-{context}']
= Renewing your own CA certificates

[role="_abstract"]
This procedure describes how to renew CA certificates that you are using instead of the certificates generated by the Cluster Operator.

*Perform the steps in this procedure when you are not also changing the corresponding CA keys.
Otherwise, perform the steps to xref:proc-replacing-your-own-private-keys-{context}[replace private keys used by your own CA certificates].*

If you are using your own certificates, the Cluster Operator will not renew them automatically.
Therefore, it is important that you follow this procedure during the renewal period of the certificate in order to replace CA certificates that will soon expire.

The procedure describes the renewal of CA certificates in PEM format.

.Prerequisites

* The Cluster Operator is running.
* xref:installing-your-own-ca-certificates-{context}[Your own CA certificates and private keys are installed].
* You have new cluster or clients X.509 certificates in PEM format.

.Procedure

. Update the `Secret` for the CA certificate.
+
Edit the existing secret to add the new CA certificate and update the certificate generation annotation value.
+
[source,shell,subs="+quotes"]
kubectl edit secret _<ca_certificate_secret_name>_
+
_<ca_certificate_secret_name>_ is the name of the `Secret`, which is `_<kafka_cluster_name>_-cluster-ca-cert` for the cluster CA certificate and `_<kafka_cluster_name>_-clients-ca-cert` for the clients CA certificate.
+
The following example shows a secret for a cluster CA certificate that's associated with a Kafka cluster named `my-cluster`.
+
.Example secret configuration for a cluster CA certificate
[source,yaml,subs=attributes+]
----
apiVersion: v1
kind: Secret
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0F... <1>
metadata:
  annotations:
    strimzi.io/ca-cert-generation: "0" <2>
  labels:
    strimzi.io/cluster: my-cluster
    strimzi.io/kind: Kafka
  name: my-cluster-cluster-ca-cert
  #...
type: Opaque
----
<1> Current base64-encoded CA certificate
<2> Current CA certificate generation annotation value

. Encode your new CA certificate into base64.
+
[source,shell,subs="+quotes"]
cat _<path_to_new_certificate>_ | base64

. Update the CA certificate.
+
Copy the base64-encoded CA certificate from the previous step as the value for the `ca.crt` property under `data`.
+
. Increase the value of the CA certificate generation annotation.
+
Update the `strimzi.io/ca-cert-generation` annotation with a higher incremental value.
For example, change `strimzi.io/ca-cert-generation=0` to `strimzi.io/ca-cert-generation=1`.
If the `Secret` is missing the annotation, the value is treated as `0`, so add the annotation with a value of `1`.
+
When Strimzi generates certificates, the certificate generation annotation is automatically incremented by the Cluster Operator.
For manual renewal of your own CA certificates, set the annotations with a higher incremental value.
The annotation needs a higher value than the one from the current secret so that the Cluster Operator can roll the pods and update the certificates.
The `strimzi.io/ca-cert-generation` has to be incremented on each CA certificate renewal.

. Save the secret with the new CA certificate and certificate generation annotation value.
+
.Example secret configuration updated with a new CA certificate
[source,yaml,subs=attributes+]
----
apiVersion: v1
kind: Secret
data:
  ca.crt: GCa6LS3RTHeKFiFDGBOUDYFAZ0F... <1>
metadata:
  annotations:
    strimzi.io/ca-cert-generation: "1" <2>
  labels:
    strimzi.io/cluster: my-cluster
    strimzi.io/kind: Kafka
  name: my-cluster-cluster-ca-cert
  #...
type: Opaque
----
<1> New base64-encoded CA certificate
<2> New CA certificate generation annotation value

On the next reconciliation, the Cluster Operator performs a rolling update of ZooKeeper, Kafka, and other components to trust the new CA certificate.

If maintenance time windows are configured, the Cluster Operator will roll the pods at the first reconciliation within the next maintenance time window.
