// Module included in the following assemblies:
//
// * security/certificate_types_descriptions/node-certificates.adoc

:_mod-docs-content-type: PROCEDURE
[id="renewing-node-certificates_{context}"]
= Renewing node certificates

[role="_abstract"]
Although the kubelet CA certificate automatically renews at 292 days, you can manually trigger renewal earlier by annotating the `kube-apiserver-to-kubelet-signer` secret.

The old CA certificate is removed after 365 days. Nodes are not rebooted when a kubelet CA certificate is renewed or removed.

.Procedure

* Annotate the secret to trigger manual renewal by running the following command:
+
[source,terminal]
----
$ oc annotate -n openshift-kube-apiserver-operator secret kube-apiserver-to-kubelet-signer auth.openshift.io/certificate-not-after-
----
