How to fix x509: certificate has expired or is not yet valid in Kubernetes

sudo kubeadm certs check-expiration

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep "Not After"
# Or just the date:
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -enddate

sudo kubeadm certs renew all

sudo systemctl restart kubelet
# OR (static pods):
kubectl delete pod -n kube-system <apiserver-pod>
kubectl delete pod -n kube-system <etcd-pod>

sudo kubeadm certs check-expiration
# Should show ~1 year residual time for all certs

# Verify kubectl works
kubectl get nodes

timedatectl status
ntpstat

# Sync time if needed
sudo timedatectl set-ntp true
sudo ntpdate -s time.nist.gov

kubectl get csr
kubectl certificate approve <csr-name>

# Check new cert is loaded
openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -enddate

# 1. SSH to control plane node or boot recovery image
# 2. Mount root filesystem if needed
# 3. Renew certs
sudo kubeadm certs renew all

# 4. Copy renewed certs to all control plane nodes
sudo scp -r /etc/kubernetes/pki <node2>:/etc/kubernetes/

# 5. Restart kubelet on all nodes
sudo systemctl restart kubelet

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml

# Create issuer for internal CA
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: kubernetes-ca
spec:
  ca:
    secretName: kubernetes-ca-secret
EOF