How to Renew the API Server Certificate Using kubeadm certs renew
After running 'kubeadm certs check-expiration', an admin sees that the 'apiserver' certificate expires in 30 days. Which command should be used to renew it?
Quick Answer
The answer is `kubeadm certs renew apiserver`. This command is correct because it is the dedicated kubeadm subcommand that renews the API server certificate in place using the existing cluster CA, without requiring a full control plane restart. The renewed certificate is automatically picked up after the static pod for the API server is restarted by the kubelet, making it a targeted and safe renewal method. On the Certified Kubernetes Administrator CKA exam, this scenario tests your ability to manage certificate lifecycle without disrupting cluster operations—a common trap is reaching for `kubeadm init phase certs` or manually editing files, which are unnecessary here. Remember that `kubeadm certs renew` handles individual certificates by name, so you specify the exact component like `apiserver`. A useful memory tip: think "renew apiserver" as a single, precise action—just like you would renew a single key on a keyring, not rebuild the whole ring.
⚠ Common exam trap
Test-takers frequently confuse `kubeadm certs renew` with `kubectl certificate` (which handles CSR approval, not renewal) or attempt a manual openssl command that breaks the trust chain, while the correct approach is the kubeadm-managed renewal that preserves CA-signed trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubeadm certs renew apiserver
`kubeadm certs renew apiserver` is the dedicated kubeadm command to renew the API server certificate without restarting the control plane. It updates the certificate in place using the existing CA, and the new certificate is automatically picked up after a static pod restart or kubelet reload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubeadm upgrade node
Why it's wrong here
Upgrade node does not renew certificates.
- ✗
openssl req -new -x509 -days 365 -key /etc/kubernetes/pki/apiserver.key -out /etc/kubernetes/pki/apiserver.crt
Why it's wrong here
Manual certificate generation is not the recommended approach; kubeadm certs renew is the proper method.
- ✓
kubeadm certs renew apiserver
Why this is correct
This renews the apiserver certificate.
- ✗
kubectl certificate renew apiserver
Why it's wrong here
kubectl does not have a 'certificate renew' command.
Go deeper
Related to this question
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CKA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?
medium- ✓ A.kubeadm certs check-expiration
- B.kubeadm upgrade plan
- C.kubeadm certs renew
- D.kubectl get certificates
Why A: The `kubeadm certs check-expiration` command is the correct tool to inspect the expiration dates of all certificates generated by kubeadm for cluster components, such as the API server, controller-manager, scheduler, and etcd. It reads the certificate files from the default kubeadm certificate directory (`/etc/kubernetes/pki`) and displays their remaining validity period in a human-readable table. This command is part of the kubeadm certificate management suite and is specifically designed for this purpose.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.