<commit_before>// Module included in the following assemblies:
//
// assembly-security.adoc

[id='proc-renewing-ca-certs-manually-{context}']

= Renewing CA certificates manually

Unless the `Kafka.spec.clusterCa.generateCertificateAuthority` and `Kafka.spec.clientsCa.generateCertificateAuthority` objects are set to `false`, the cluster and clients CA certificates will auto-renew at the start of their respective certificate renewal periods. 
You can manually renew one or both of these certificates before the certificate renewal period starts, if required for security reasons. 
A renewed certificate uses the same private key as the old certificate.

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster in which CA certificates and private keys are installed.

.Procedure

* Apply the `strimzi.io/force-renew` annotation to the `Secret` that contains the CA certificate that you want to renew.
+
[cols="3*",options="header",stripes="none",separator=¦]
|===

¦Certificate
¦Secret
¦Annotate command

¦Cluster CA
¦_<cluster-name>_-cluster-ca-cert
m¦kubectl annotate secret _<cluster-name>_-cluster-ca-cert strimzi.io/force-renew=true

¦Clients CA
¦_<cluster-name>_-clients-ca-cert
m¦kubectl annotate secret _<cluster-name>_-clients-ca-cert strimzi.io/force-renew=true

|===

At the next reconciliation the Cluster Operator will generate a new CA certificate for the `Secret` that you annotated. 
If maintenance time windows are configured, the Cluster Operator will generate the new CA certificate at the first reconciliation within the next maintenance time window.

Client applications must reload the cluster and clients CA certificates that were renewed by the Cluster Operator.

.Additional resources

* xref:certificates-and-secrets-str[]

* xref:assembly-maintenance-time-windows-deployment-configuration-kafka[]

* xref:type-CertificateAuthority-reference[]
<commit_msg>[DOC] Remove the old certificates after a renewal of Cluster CA (#3486)<commit_after>// Module included in the following assemblies:
//
// assembly-security.adoc

[id='proc-renewing-ca-certs-manually-{context}']

= Renewing CA certificates manually

Unless the `Kafka.spec.clusterCa.generateCertificateAuthority` and `Kafka.spec.clientsCa.generateCertificateAuthority` objects are set to `false`,
the cluster and clients CA certificates will auto-renew at the start of their respective certificate renewal periods.

You can manually renew one or both of these certificates before the certificate renewal period starts, if required for security reasons.
A renewed certificate uses the same private key as the old certificate.

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster in which CA certificates and private keys are installed.

.Procedure

. Apply the `strimzi.io/force-renew` annotation to the `Secret` that contains the CA certificate that you want to renew.
+
.Annotation for Secret that forces renewal of certificates
[cols="3*",options="header",stripes="none",separator=¦]
|===

¦Certificate
¦Secret
¦Annotate command

¦Cluster CA
¦_KAFKA-CLUSTER-NAME_-cluster-ca-cert
m¦kubectl annotate secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert strimzi.io/force-renew=true

¦Clients CA
¦_KAFKA-CLUSTER-NAME_-clients-ca-cert
m¦kubectl annotate secret _KAFKA-CLUSTER-NAME_-clients-ca-cert strimzi.io/force-renew=true

|===
+
At the next reconciliation the Cluster Operator will generate a new CA certificate for the `Secret` that you annotated.
If maintenance time windows are configured, the Cluster Operator will generate the new CA certificate at the first reconciliation within the next maintenance time window.
+
Client applications must reload the cluster and clients CA certificates that were renewed by the Cluster Operator.

. Delete old certificates from the Secret.
+
When components are using the new certificates, older certificates might still be active.
Delete the old certificates to remove any potential security risk.

.Additional resources

* xref:certificates-and-secrets-str[]

* xref:assembly-maintenance-time-windows-deployment-configuration-kafka[]

* xref:type-CertificateAuthority-reference[]

{'fraction_non_alphanumeric': 0.07744433688286544, 'fraction_numerical': 0.001452081316553727, 'mean_word_length': 5.338957055214724, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6035966', 'n_tokens_mistral': 1195, 'n_tokens_neox': 1091, 'n_words': 440}