Red Hat OpenShift Container Platform

Manually rotate the generated service certificate

To replace a generated service serving certificate in Red Hat OpenShift Container Platform, you can delete the TLS secret named in the service serving-cert-secret-name annotation. A new secret and certificate pair are created automatically.

Prerequisites

A secret containing the certificate and key pair must have been generated for the service.

Procedure

Examine the service to determine the secret containing the certificate. This is found in the serving-cert-secret-name annotation, as seen below.
```
$ oc describe service <service_name>
```
Example output
```
...
service.beta.openshift.io/serving-cert-secret-name: <secret>
...
```
Delete the generated secret for the service. This process will automatically recreate the secret.
```
$ oc delete secret <secret>
```
- Replace <secret> with the name of the secret from the previous step.

Confirm that the certificate has been recreated by obtaining the new secret and examining the AGE.

$ oc get secret <service_name>

Example output

NAME              TYPE                DATA   AGE
<service.name>    kubernetes.io/tls   2      1s