Fix Kubernetes Certificate Expiration Errors with kubeadm Commands

When running kubectl you may encounter the error

Unable to connect to the server: x509: certificate has expired or is not yet valid

, indicating that the cluster certificates are out of date.

Solution

Use the kubeadm alpha sub‑commands to manage and renew the certificates.

Renew all certificates: kubeadm alpha certs renew all The command outputs renewal information for each component.

Copy the newly generated admin kubeconfig to your local ~/.kube/config :

sudo kubeadm alpha kubeconfig user --client-name=admin --org=system:masters > /tmp/admin.conf
sudo cp /tmp/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Restart the kubelet service so the cluster can use the refreshed certificates: systemctl restart kubelet Verify that the certificates have been renewed and check their new expiration dates: kubeadm alpha certs check-expiration The output lists each certificate with its new expiration date (e.g., Jan 25, 2026).

Note: In Kubernetes 1.15 the command is kubeadm certs check-expiration. In newer versions (e.g., 1.19) the certs sub‑command resides under kubeadm alpha, so replace kubeadm certs with kubeadm alpha certs to run the commands successfully.