// Module included in the following assemblies:
//
// * edge_computing/day_2_core_cnf_clusters/troubleshooting/troubleshooting-cert-maintenance.adoc

:_mod-docs-content-type: CONCEPT
[id="troubleshooting-certs-auto-etcd_{context}"]
= Certificates managed by etcd

[role="_abstract"]
The etcd certificates are used for encrypted communication between etcd member peers as well as encrypted client traffic. 
The certificates are renewed automatically within the cluster provided that communication between all nodes and all services is current.
Therefore, if your cluster might lose communication between components during a specific period of time, which is close to the end of the etcd certificate lifetime, it is recommended to renew the certificate in advance.
For example, communication can be lost during an upgrade due to nodes rebooting at different times.

* You can manually renew etcd certificates by running the following command:
+
[source,terminal]
----
$ for each in $(oc get secret -n openshift-etcd | grep "kubernetes.io/tls" | grep -e \
"etcd-peer\|etcd-serving" | awk '{print $1}'); do oc get secret $each -n openshift-etcd -o \
jsonpath="{.data.tls\.crt}" | base64 -d | openssl x509 -noout -enddate; done
----

For more information about updating etcd certificates, see link:https://access.redhat.com/solutions/7000968[Checking etcd certificate expiry in OpenShift 4].
For more information about etcd certificates, see "etcd certificates" in _Security and compliance_.