:_mod-docs-content-type: ASSEMBLY
[id="cert-types-control-plane-certificates"]
= Control plane certificates
include::_attributes/common-attributes.adoc[]
:context: cert-types-control-plane-certificates

toc::[]

[role="_abstract"]
Review control plane certificate namespaces and automatic rotation in {product-title} to plan maintenance and recover from expiration.

[id="control-plane-certs-location_{context}"]
== Location

Control plane certificates are included in these namespaces:

* `openshift-config-managed`
* `openshift-kube-apiserver`
* `openshift-kube-apiserver-operator`
* `openshift-kube-controller-manager`
* `openshift-kube-controller-manager-operator`
* `openshift-kube-scheduler`

[id="control-plane-certs-management_{context}"]
== Management

Control plane certificates are managed by the system and rotated automatically.

If control plane certificates expire, see "Recovering from expired control plane certificates".

[role="_additional-resources"]
== Additional resources

* xref:../../backup_and_restore/control_plane_backup_and_restore/disaster_recovery/scenario-3-expired-certs.adoc#dr-recovering-expired-certs[Recovering from expired control plane certificates]
