:_mod-docs-content-type: ASSEMBLY
[id="cert-types-user-provided-certificates-for-the-api-server"]
= User-provided certificates for the API server
include::_attributes/common-attributes.adoc[]
:context: cert-types-user-provided-certificates-for-the-api-server

toc::[]

[role="_abstract"]
Review user-provided TLS certificates for the API server in {product-title} to understand their purpose, location, management, and expiration for external client access.

[id="user-provided-certificates-for-api-server-purpose_{context}"]
== Purpose

The API server is accessible by clients external to the cluster at `api.<cluster_name>.<base_domain>`. You might want clients to access the API server at a different hostname or without the need to distribute the cluster-managed certificate authority (CA) certificates to the clients. The administrator must set a custom default certificate to be used by the API server when serving content.

[id="user-provided-certificates-for-api-server-location_{context}"]
== Location

The user-provided certificates must be provided in a `kubernetes.io/tls` type `Secret` in the `openshift-config` namespace. Update the API server cluster configuration, the `apiserver/cluster` resource, to enable the use of the user-provided certificate.

[id="user-provided-certificates-for-api-server-management_{context}"]
== Management

User-provided certificates are managed by the user.

[id="user-provided-certificates-for-api-server-expiration_{context}"]
== Expiration

API server client certificate expiration is less than five minutes.

[id="user-provided-certificates-for-api-server-customization_{context}"]
== Customization

Update the secret containing the user-managed certificate as needed.


[role="_additional-resources"]
== Additional resources

* xref:../../security/certificates/api-server.adoc#api-server-certificates[Adding API server certificates]
