How to Renew the kube-apiserver Certificate Using kubeadm
You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?
Quick Answer
The answer is `kubeadm certs renew apiserver`. This command is the correct way to renew just the kube-apiserver certificate because `kubeadm certs renew` targets a specific component certificate using the existing cluster CA key, regenerating only that certificate with an updated expiration date while preserving the same Subject and SANs. On the Certified Kubernetes Administrator CKA exam, this tests your ability to manage certificate lifecycle without disrupting other control plane components; a common trap is running `kubeadm init phase certs apiserver` or `kubeadm alpha certs renew`, which are either outdated or affect the entire PKI. The exam expects you to know that `kubeadm certs renew` is the modern, granular approach introduced in kubeadm v1.15+. A useful memory tip: think of the command as "renew specific, not all" — the verb "renew" followed by the component name keeps the rest of your certificates untouched.
⚠ Common exam trap
Test-takers frequently confuse the deprecated `kubeadm alpha` subcommand with the current `kubeadm certs` subcommand, or mistakenly think `kubectl` can manage kubeadm certificates, leading them to pick options that are either outdated or nonexistent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubeadm certs renew apiserver
`kubeadm certs renew apiserver` is the standard command in modern kubeadm (v1.15+) to renew a specific certificate without affecting others. It regenerates the apiserver certificate using the existing CA key, updating the expiration date while keeping the same Subject and SANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubeadm alpha certs renew apiserver
Why it's wrong here
Alpha command deprecated.
- ✓
kubeadm certs renew apiserver
Why this is correct
Renews the specific certificate.
- ✗
kubeadm init phase certs apiserver --renew
Why it's wrong here
Incorrect syntax.
- ✗
kubectl create certificate apiserver
Why it's wrong here
kubectl does not manage kubeadm certificates.
Go deeper
Related to this question
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CKA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to check the expiration date of certificates used by the kube-apiserver. Which command should you use?
medium- A.kubeadm certs renew
- B.kubectl get secrets -n kube-system
- C.openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout
- ✓ D.kubeadm certs check-expiration
Why D: `kubeadm certs check-expiration` is the dedicated kubeadm command to display the expiration dates of all certificates managed by kubeadm in the cluster, including the kube-apiserver certificate. This command reads the certificate files from `/etc/kubernetes/pki/` and outputs the remaining validity period for each, making it the most direct and accurate method for checking certificate expiration in a kubeadm-deployed cluster.
Variation 2. A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?
hard- A.kubeadm upgrade plan --certificate-expiration
- B.kubectl config view --raw | grep client-certificate
- C.openssl x509 -in /etc/kubernetes/admin.conf -text -noout
- ✓ D.kubeadm certs check-expiration
Why D: `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.