Kubernetes: x509 certificate has expired or is not yet valid

Fix Kubernetes x509 expiry errors from cluster CA rotation, kubelet certificates, and expired service-account or webhook certificates.

advanceddebuggingkubernetestlscertificates

Symptoms

x509: certificate has expired or is not yet valid
kubelet cannot reach the API server after a long uptime
Webhook calls fail after a year of operation

Possible causes

Kubelet client certificates were not rotated before expiry
A cluster CA or API server certificate expired
A webhook serving certificate expired
System clock skew makes a valid certificate appear not yet valid

Diagnosis steps

Identify which certificate the error names

Interpretation

The error often names the CN or SAN, telling you whether it is kubelet, API server, or webhook.

Check expiry on control-plane certificates

kubeadm certs check-expiration

Interpretation

The command lists every certificate and its remaining lifetime.

Verify node and control-plane time

timedatectl

Interpretation

Clock skew causes not-yet-valid errors even for freshly issued certificates.

Root cause

TLS certificates have a validity window. Kubernetes components verify each other against the cluster CA, so any expired certificate in the chain — kubelet client cert, API server serving cert, webhook cert — breaks the handshake. Rotation must happen before expiry; a missed rotation fails only after the certificate lapses, often during otherwise routine traffic.

Fix

Renew control-plane and kubelet certificates before expiry with kubeadm certs renew and kubelet rotation, and configure kubelet certificate rotation so it renews automatically. Reissue webhook certificates and update the corresponding Secret. Check and synchronise clocks on nodes and the control plane.

Verify the fix

Run kubeadm certs check-expiration again; all certificates show renewed lifetimes, kubelet reconnects, and webhook calls succeed without x509 errors.

Symptoms

Kubernetes components log x509: certificate has expired or is not yet valid. It may appear suddenly after months of uptime, since nothing changes until a certificate lapses.

Diagnosis

Find the certificate and its expiry:

kubeadm certs check-expiration
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -dates
timedatectl

Fix

Renew and enable rotation:

kubeadm certs renew all
systemctl restart kubelet

Configure kubelet client certificate rotation so it renews automatically before expiry.

Verification

Re-run kubeadm certs check-expiration; every certificate shows a future expiry, kubelet connects to the API server, and webhooks serve without x509 errors.

Why Expiry Strikes Suddenly

Certificates do not degrade gradually; they are valid one second and invalid the next, so an expiry outage appears with no warning in metrics until components start failing at once. Kubelet client certificates rotate automatically only when rotation is enabled and the certificate is close enough to expiry, and the cluster CA itself has a long lifetime that many teams forget to track. Monitoring certificate expiry as a standing alert, treating rotation as routine maintenance, and testing the renewal path before it is needed turns a hard outage into an uneventful, scheduled event.