:_mod-docs-content-type: ASSEMBLY
[id="troubleshooting-cert-maintenance"]
= Certificate maintenance
include::_attributes/common-attributes.adoc[]
:context: troubleshooting-cert-maintenance

toc::[]

Certificate maintenance is required for continuous cluster authentication.
As a cluster administrator, you must manually renew certain certificates, while others are automatically renewed by the cluster.

Learn about certificates in {product-title} and how to maintain them by using the following resources:

* link:https://access.redhat.com/solutions/5018231[Which OpenShift certificates do rotate automatically and which do not in Openshift 4.x?]
* link:https://access.redhat.com/solutions/7000968[Checking etcd certificate expiry in OpenShift 4]

include::modules/troubleshooting-certs-manual.adoc[leveloffset=+1]
include::modules/troubleshooting-certs-manual-proxy.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../../security/certificate_types_descriptions/proxy-certificates.adoc#proxy-certificates[Proxy certificates]

include::modules/troubleshooting-certs-manual-user-provisioned.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../../security/certificate_types_descriptions/user-provided-certificates-for-api-server.adoc#cert-types-user-provided-certificates-for-the-api-server[User-provisioned certificates for the API server]

include::modules/troubleshooting-certs-auto.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources

* xref:../../../security/certificate_types_descriptions/service-ca-certificates.adoc#cert-types-service-ca-certificates_cert-types-service-ca-certificates[Service CA certificates]
* xref:../../../security/certificate_types_descriptions/node-certificates.adoc#cert-types-node-certificates_cert-types-node-certificates[Node certificates]
* xref:../../../security/certificate_types_descriptions/bootstrap-certificates.adoc#cert-types-bootstrap-certificates_cert-types-bootstrap-certificates[Bootstrap certificates]
* xref:../../../security/certificate_types_descriptions/etcd-certificates.adoc#cert-types-etcd-certificates-cert-types-etcd-certificates[etcd certificates]
* xref:../../../security/certificate_types_descriptions/olm-certificates.adoc#cert-types-olm-certificates_cert-types-olm-certificates[OLM certificates]
* xref:../../../security/certificate_types_descriptions/machine-config-operator-certificates.adoc#cert-types-machine-config-operator-certificates_cert-types-machine-config-operator-certificates[Machine Config Operator certificates]
* xref:../../../security/certificate_types_descriptions/monitoring-and-cluster-logging-operator-component-certificates.adoc#cert-types-monitoring-and-cluster-logging-operator-component-certificates_cert-types-monitoring-and-cluster-logging-operator-component-certificates[Monitoring and cluster logging Operator component certificates]
* xref:../../../security/certificate_types_descriptions/control-plane-certificates.adoc#cert-types-control-plane-certificates_cert-types-control-plane-certificates[Control plane certificates]
* xref:../../../security/certificate_types_descriptions/ingress-certificates.adoc#cert-types-ingress-certificates_cert-types-ingress-certificates[Ingress certificates]

include::modules/troubleshooting-certs-auto-etcd.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../../security/certificate_types_descriptions/etcd-certificates.adoc#cert-types-etcd-certificates_cert-types-etcd-certificates[etcd certificates]

include::modules/troubleshooting-certs-auto-node.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../../security/certificate_types_descriptions/node-certificates.adoc#cert-types-node-certificates_cert-types-node-certificates[Node certificates]

include::modules/troubleshooting-certs-auto-service-ca.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../../security/certificate_types_descriptions/service-ca-certificates.adoc#cert-types-service-ca-certificates_cert-types-service-ca-certificates[Service CA certificates]