// Module included in the following assemblies:
//
// security/certificate_types_descriptions/etcd-certificates.adoc

:_mod-docs-content-type: PROCEDURE
[id="rotating-certificate-authority_{context}"]
= Rotating the etcd certificate

[role="_abstract"]
You can manually rotate the etcd certificate before its automatic, scheduled rotation by backing up and deleting the current signer certificate.

.Procedure

. Make a backup copy of the current signer certificate by running the following command:
+
[source,terminal]
----
$ oc get secret -n openshift-etcd etcd-signer -oyaml > signer_backup_secret.yaml
----

. Delete the existing signer certificate by running the following command:
+
[source,terminal]
----
$ oc delete secret -n openshift-etcd etcd-signer
----

.Verification

* Wait for the static pod roll out by running the following command. The static pod roll out can take a few minutes to complete.
+
[source,terminal]
----
$ oc wait --for=condition=Progressing=False --timeout=15m clusteroperator/etcd
----

