// Module included in the following assemblies:
//
// assembly-security.adoc

[id='proc-replacing-private-keys-{context}']

= Replacing private keys used by Cluster Operator-managed CA certificates

You can replace the private keys used by the cluster CA and clients CA certificates generated by the Cluster Operator.
When a private key is replaced, the Cluster Operator generates a new CA certificate for the new private key.

NOTE: If you are using your own CA certificates, the `force-replace` annotation cannot be used.
Instead, follow the procedure for xref:renewing-your-own-ca-certificates-{context}[renewing your own CA certificates].

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster in which CA certificates and private keys are installed.

.Procedure

* Apply the `strimzi.io/force-replace` annotation to the `Secret` that contains the private key that you want to renew.
+
.Commands for replacing private keys
[cols="3*",options="header",stripes="none",separator=¦]
|===

¦Private key for
¦Secret
¦Annotate command

¦Cluster CA
¦_CLUSTER-NAME_-cluster-ca
m¦kubectl annotate secret _CLUSTER-NAME_-cluster-ca strimzi.io/force-replace=true

¦Clients CA
¦_CLUSTER-NAME_-clients-ca
m¦kubectl annotate secret _CLUSTER-NAME_-clients-ca strimzi.io/force-replace=true

|===

At the next reconciliation the Cluster Operator will:

* Generate a new private key for the `Secret` that you annotated

* Generate a new CA certificate

If maintenance time windows are configured, the Cluster Operator will generate the new private key and CA certificate at the first reconciliation within the next maintenance time window.

Client applications must reload the cluster and clients CA certificates that were renewed by the Cluster Operator.

[role="_additional-resources"]
.Additional resources

* xref:certificates-and-secrets-str[]
* xref:assembly-maintenance-time-windows-str[]
