title: Kubernetes: expired certificate
body: <p>Our Kubernetes 1.6 cluster had certificates generated when the cluster was built on April 13th, 2017.</p>
  
  <p>On December 13th, 2017, our cluster was upgraded to version 1.8, and new certificates were generated [apparently, an incomplete set of certificates].</p>
  
  <p>On April 13th, 2018, we started seeing this message within our Kubernetes dashboard for api-server:</p>
  
  <p><code>[authentication.go:64] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]</code></p>
  
  <p>Tried pointing <strong>client-certificate</strong> &amp; <strong>client-key</strong> within <code>/etc/kubernetes/kubelet.conf</code> at the certificates generated on Dec 13th [<code>apiserver-kubelet-client.crt</code> and <code>apiserver-kubelet-client.crt</code>], but continue to see the above error.</p>
  
  <p>Tried pointing <strong>client-certificate</strong> &amp; <strong>client-key</strong> within <code>/etc/kubernetes/kubelet.conf</code> at <strong>different</strong> certificates generated on Dec 13th [<code>apiserver.crt</code> and <code>apiserver.crt</code>] (I honestly don't understand the difference between these 2 sets of certs/keys), but continue to see the above error.</p>
  
  <p>Tried pointing <strong>client-certificate</strong> &amp; <strong>client-key</strong> within <code>/etc/kubernetes/kubelet.conf</code> at non-existent files, and none of the kube* services would start, with <code>/var/log/syslog</code> complaining about this:</p>
  
  <p><code>Apr 17 17:50:08 kuber01 kubelet[2422]: W0417 17:50:08.181326    2422 server.go:381] invalid kubeconfig: invalid configuration: [unable to read client-cert /tmp/this/cert/does/not/exist.crt for system:node:node01 due to open /tmp/this/cert/does/not/exist.crt: no such file or directory, unable to read client-key /tmp/this/key/does/not/exist.key for system:node:node01 due to open /tmp/this/key/does/not/exist.key: no such file or directory]</code></p>
  
  <p>Any advice on how to overcome this error, or even troubleshoot it at a more granular level?  Was considering regenerating certificates for api-server (<code>kubeadm alpha phase certs apiserver</code>), based on instructions within <a href="https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-alpha/#cmd-phase-certs" rel="noreferrer">https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-alpha/#cmd-phase-certs</a> ... but not sure if I'd be doing more damage.</p>
  
  <p>Relatively new to Kubernetes, and the gentleman who set this up is not available for consult ... any help is appreciated.  Thanks.</p>