:_mod-docs-content-type: ASSEMBLY
[id="api-server-certificates"]
= Adding API server certificates
include::_attributes/common-attributes.adoc[]
:context: api-server-certificates

toc::[]

[role="_abstract"]
To allow clients outside of the cluster to verify the API server's certificate, you can replace the default API server certificate with one that is issued by a CA that clients trust.

By default, the API server certificate is issued by an internal {product-title} cluster CA. As a result, clients outside of the cluster cannot verify the API server's certificate.

[NOTE]
====
In hosted control plane clusters, you can add as many custom certificates to your Kubernetes API Server as you need. However, do not add a certificate for the endpoint that worker nodes use to communicate with the control plane. For more information, see xref:../../hosted_control_planes/hcp-deploy/hcp-deploy-bm.adoc#hcp-custom-cert_hcp-deploy-bm[Configuring a custom API server certificate in a hosted cluster].
====

include::modules/customize-certificates-api-add-named.adoc[leveloffset=+1]
include::modules/customize-certificates-api-renew-named.adoc[leveloffset=+1]