---
title: "Renew the cluster certificate"
description: "How an E2E Kubernetes cluster's API certificate is renewed each year, and how to get kubectl working with the new certificate afterwards."
content_type: "how-to"
product: "kubernetes"
platform: "MyAccount"
url: "/myaccount/kubernetes/how-to/renew-the-cluster-certificate/"
topic: ["operate"]
relationships: {"requires":["/myaccount/kubernetes/how-to/connect-with-kubectl/"]}
---

# Renew the cluster certificate

kubectl connects to your cluster over a certificate that is due for renewal one year after the
cluster is created, and one year after each renewal. E2E renews the certificate on its renewal date
while the cluster reads **Running**. After a renewal, you download the kubeconfig again so that
kubectl has the new certificate.

## Before you begin

- Your cluster reads **Running** on its renewal date, one year after it was created or last renewed.
- You know every computer and CI system that uses the cluster's kubeconfig, so you can replace each
  copy after the renewal.

## (Optional) Renew the certificate yourself before its date

In the five days before the renewal date, you can also start a renewal yourself, to choose the
moment. On **Cluster Details**, click **Click Here**. The renewal starts at once. **SSL is renewed
successfully.** confirms it. At any other time, the request is refused with **SSL Renewal Not
Allowed!!!**

## Download the kubeconfig again

After a renewal, whether you started it or E2E did, E2E emails you. The kubeconfig you download from
then on has the new certificate, so download it again and point kubectl at the new copy; see
[Connect to a cluster with kubectl](/myaccount/kubernetes/how-to/connect-with-kubectl/#download-the-kubeconfig).
Replace the copy on every computer and in every CI system that uses it.

## Check that kubectl connects

Run:

```bash
kubectl get nodes
```

kubectl lists the cluster's nodes. If it reports
`x509: certificate has expired or is not yet valid`, see
[kubectl says x509: certificate has expired or is not yet valid](/myaccount/kubernetes/troubleshooting/kubernetes/#kubectl-says-x509-certificate-has-expired-or-is-not-yet-valid).

If a renewal fails, E2E's support team is emailed to finish it. To follow it up,
[contact support](/myaccount/kubernetes/troubleshooting/kubernetes/#contact-support) with the
cluster's name.

The cluster's next renewal date is one year after this renewal.