CKA Practice Question: Cluster Architecture, Installation and Configuration
Which command can you use to check the expiration date of certificates managed by kubeadm?
⚠ Common exam trap
Test-takers frequently confuse the `kubeadm certs` subcommands, often misremembering `list` or inventing flags like `--check`, when the actual command uses the precise verb `check-expiration` to separate inspection from renewal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubeadm certs check-expiration
The correct command is `kubeadm certs check-expiration`, which is a dedicated kubeadm subcommand that inspects all certificates managed by kubeadm and displays their expiration dates, remaining validity, and renewal status. This command reads the certificate files from `/etc/kubernetes/pki/` and parses their X.509 metadata, providing a concise summary without requiring external tools like OpenSSL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kubeadm certs check-expiration
Why this is correct
The `kubeadm certs check-expiration` command is the official kubeadm subcommand for inspecting the validity of all certificates managed by kubeadm. It reads the certificate files from the default PKI directory (usually /etc/kubernetes/pki) and from the kubeconfig files in /etc/kubernetes, then prints a table showing the remaining validity period for each certificate. This is the canonical way to audit certificate expiration on a cluster bootstrapped with kubeadm, and it also displays the CA certificates separately from the leaf certificates.
- ✗
kubectl get certificates
Why it's wrong here
`kubectl get certificates` is invalid because there is no core Kubernetes API resource named `certificates`. The closest resource is `CertificateSigningRequest` (CSR) in the `certificates.k8s.io` API group, but its plural is `certificatesigningrequests` (or alias `csr`), not `certificates`. Even if the resource name were correct, kubectl operates against the Kubernetes API server, which has no access to the certificate files on the control-plane nodes, so it cannot read the local PKI expiration data that `kubeadm certs check-expiration` inspects.
- ✗
kubeadm certs list
Why it's wrong here
`kubeadm certs list` is not a real subcommand. The kubeadm certificate management command group includes only `check-expiration`, `renew`, and `generate-csr` (with `help` as a generic subcommand). Running `kubeadm certs list` produces an error like 'unknown command "list" for "kubeadm certs"'. Unlike `check-expiration`, which scans and validates the actual certificate files, no `list` subcommand exists to enumerate them, so this option cannot possibly show expiration dates.
- ✗
kubeadm certs renew --check
Why it's wrong here
`kubeadm certs renew --check` mixes two concepts: the `renew` subcommand is designed to actually renew certificates, not to inspect them. Its supported flags include `--config`, `--kubeconfig`, `--csr-only`, and `--cert-dir`, but `--check` is not among them. In fact, the `--check` flag is not defined for any kubeadm command, and attempting to use it returns a flag-not-found error. Certificate expiration checking is a dedicated read-only operation handled exclusively by `kubeadm certs check-expiration`, not a dry-run mode of renewal.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.