// Module included in the following assemblies:
//
// assembly-security.adoc

[id='proc-renewing-ca-certs-manually-{context}']

= Renewing CA certificates manually

Unless the `Kafka.spec.clusterCa.generateCertificateAuthority` and `Kafka.spec.clientsCa.generateCertificateAuthority` objects are set to `false`, the cluster and clients CA certificates will auto-renew at the start of their respective certificate renewal periods. 
You can manually renew one or both of these certificates before the certificate renewal period starts, if required for security reasons. 
A renewed certificate uses the same private key as the old certificate.

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster in which CA certificates and private keys are installed.

.Procedure

* Apply the `strimzi.io/force-renew` annotation to the `Secret` that contains the CA certificate that you want to renew.
+
[cols="3*",options="header",stripes="none",separator=¦]
|===

¦Certificate
¦Secret
¦Annotate command

¦Cluster CA
¦_<cluster-name>_-cluster-ca-cert
m¦kubectl annotate secret _<cluster-name>_-cluster-ca-cert strimzi.io/force-renew=true

¦Clients CA
¦_<cluster-name>_-clients-ca-cert
m¦kubectl annotate secret _<cluster-name>_-clients-ca-cert strimzi.io/force-renew=true

|===

At the next reconciliation the Cluster Operator will generate a new CA certificate for the `Secret` that you annotated. 
If maintenance time windows are configured, the Cluster Operator will generate the new CA certificate at the first reconciliation within the next maintenance time window.

Client applications must reload the cluster and clients CA certificates that were renewed by the Cluster Operator.

.Additional resources

* xref:certificates-and-secrets-str[]

* xref:assembly-maintenance-time-windows-deployment-configuration-kafka[]

* xref:type-CertificateAuthority-reference[]
