// Module included in the following assemblies:
//
// * security/certificate_types_descriptions/etcd-certificates.adoc

:_mod-docs-content-type: CONCEPT    
[id="etcd-cert-alerts-metrics-signer_{context}"]
= etcd certificate rotation alerts and metrics signer certificates

[role="_abstract"]
Monitor etcd signer expiration alerts and rotate the metrics signer using the `etcd-metric-signer` parameter and the `etcd-metrics-ca-bundle` when required, so you avoid certificate expiration and maintain secure etcd metrics traffic.

`etcdSignerCAExpirationWarning`:: Occurs 730 days until the signer expires.
`etcdSignerCAExpirationCritical`:: Occurs 365 days until the signer expires.

These alerts track the expiration date of the signer certificate authorities in the `openshift-etcd` namespace.

You can rotate the certificate for the following reasons:

* You receive an expiration alert.
* The private key is leaked.

[IMPORTANT]
====
When a private key is leaked, you must rotate all of the certificates.
====

There is a separate etcd signer for the {product-title} metrics system. To rotate the separate etcd signer, follow the steps in "Rotating the etcd certificate" using the following parameters:

* Use the `etcd-metric-signer` parameter instead of the `etcd-signer`
* Use `etcd-metrics-ca-bundle` bundle instead ofthe  `etcd-ca-bundle`

