How to fix Unable to connect to the server: x509: certificate has expired in Kubernetes

KubernetesINTERMEDIATECRITICALUpdated Dec 5, 2025· 252 views

This error occurs when Kubernetes certificates have expired, preventing TLS connections between kubectl and the API server or between cluster components. Certificate renewal is required to restore cluster access.

Quick fix

Fixes Unable to connect to the server: x509: certificate has expired

date
timedatectl status
chronyc tracking  # on chrony-based systems
  1. Check the system clock on all nodes
  2. Check which certificates have expired using kubeadm
  3. Backup the current Kubernetes PKI directory
  4. Renew all cluster certificates using kubeadm
kubernetes — error
date
timedatectl status
chronyc tracking  # on chrony-based systems
Unable to connect to the server: x509: certificate has expired

What this error means

This error occurs when Kubernetes is unable to establish a TLS connection with the API server because one or more certificates in the cluster have expired. Kubernetes uses X.509 certificates for authentication and encryption between the kubectl client and the API server, between control plane components (API server, controller manager, scheduler), and between kubelet and the API server. When these certificates exceed their validity period (typically 1 year for kubeadm-created clusters), the cryptographic validation fails, blocking all cluster communication. The error specifically indicates that the TLS handshake cannot complete because the server's certificate (or client certificate) has passed its 'Not After' validity date. This typically affects kubeadm-managed clusters where automatic renewal hasn't occurred, or when cluster upgrades haven't been performed within the 1-year window.

Typical symptoms

  • kubectl commands immediately fail with "x509: certificate has expired" regardless of the operation
  • All cluster access is blocked—even basic commands like "kubectl get nodes" fail
  • Cluster control plane components cannot communicate with each other; etcd peers fail to sync
  • CI/CD pipelines that use kubectl fail at the point of cluster interaction
  • Worker nodes cannot reach the API server; kubelet logs show certificate validation errors
  • Multiple different kubectl contexts and clusters all fail simultaneously

Common causes

  1. kubeadm-generated certificates expired after the default 1-year validity period without cluster upgrade or manual renewal
  2. Kubernetes cluster was never upgraded, and no manual certificate renewal was performed in 12+ months
  3. Manual certificate rotation was incomplete; certificates were renewed on some control plane nodes but not others
  4. Client kubeconfig file contains an expired certificate
  5. System clock/NTP is significantly skewed on the cluster or client machine
  6. kubelet's automatic certificate rotation failed silently; CSR approval was not enabled
  7. Root CA certificate expired, invalidating all leaf certificates it signed

How to fix "Unable to connect to the server: x509: certificate has expired"

1Check the system clock on all nodes

System clock skew can make valid certificates appear expired. Verify time synchronization:

bash
date
timedatectl status
chronyc tracking  # on chrony-based systems

If clocks are out of sync by >5 minutes, restart the time sync service:

bash
sudo systemctl restart chronyd    # or ntpd
sudo timedatectl set-ntp true
2Check which certificates have expired using kubeadm

On a control plane node, use kubeadm to inspect all certificates:

bash
sudo kubeadm certs check-expiration

To manually inspect a specific kubeconfig certificate:

bash
cat ~/.kube/config | grep client-certificate-data | cut -f2 -d : | tr -d ' ' | base64 -d | openssl x509 -text -out - | grep 'Not After'

This decodes the embedded certificate and shows the exact expiration timestamp.

3Backup the current Kubernetes PKI directory

Before renewing certificates, back up the PKI directory on all control plane nodes:

bash
sudo cp -r /etc/kubernetes/pki /etc/kubernetes/pki.backup.$(date +%Y%m%d_%H%M%S)

Also backup your kubeconfig:

bash
cp ~/.kube/config ~/.kube/config.backup.$(date +%Y%m%d_%H%M%S)
4Renew all cluster certificates using kubeadm

On each control plane node, use kubeadm to renew all certificates:

bash
sudo kubeadm certs renew all

For multi-control-plane clusters, execute this on every control plane node, not just one.

You can also renew specific certificates:

bash
sudo kubeadm certs renew admin.conf      # renew admin kubeconfig
sudo kubeadm certs renew apiserver        # renew API server cert
sudo kubeadm certs renew all --dry-run   # preview changes
5Restart control plane components

After renewal, control plane components must be restarted to load the new certificates:

bash
# For kubeadm clusters, restart static pods
sudo mv /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/
sudo mv /etc/kubernetes/manifests/kube-controller-manager.yaml /tmp/
sudo mv /etc/kubernetes/manifests/kube-scheduler.yaml /tmp/
sudo mv /etc/kubernetes/manifests/etcd.yaml /tmp/

sleep 10  # wait for kubelet to stop pods

sudo mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/
sudo mv /tmp/kube-controller-manager.yaml /etc/kubernetes/manifests/
sudo mv /tmp/kube-scheduler.yaml /etc/kubernetes/manifests/
sudo mv /tmp/etcd.yaml /etc/kubernetes/manifests/

sleep 30  # wait for kubelet to restart pods

Or simply reboot the control plane node.

6Update kubectl kubeconfig with the renewed admin certificate

After renewing control plane certificates, update your local kubectl config:

bash
# Backup your current kubeconfig
cp ~/.kube/config ~/.kube/config.old

# Copy the renewed admin.conf from control plane node
scp user@control-plane-node:/etc/kubernetes/admin.conf ~/.kube/config

# Fix file permissions
chmod 600 ~/.kube/config

# Verify kubectl can connect
kubectl cluster-info
kubectl get nodes

For all users who access the cluster, distribute the renewed admin.conf.

Advanced notes

kubeadm automatically renews control plane certificates during cluster upgrades (kubeadm upgrade apply). If you perform cluster upgrades regularly (at least every 12 months), manual renewal is unnecessary. However, kubeadm does NOT automatically renew certificates if you don't upgrade.

Kubelet certificates are handled separately by kubelet's built-in certificate rotation mechanism (rotateCertificates: true in KubeletConfiguration). Kubelet automatically requests a new certificate when the current one is nearing expiration. However, this only works if the control plane is reachable.

In multi-control-plane clusters, you must run kubeadm certs renew on every control plane node. Partial renewal can cause certificate validation mismatches between nodes, breaking etcd quorum.

For Kind (Kubernetes in Docker), certificates are inside the container. You must exec into the Kind container to run renewal.

MicroK8s and K3s use different certificate management. For MicroK8s, use sudo microk8s.refresh-certs. For K3s, use k3s certificate rotate-ca.

If the root CA certificate itself expires, all leaf certificates become invalid. This is rare (CA certs default to 10 years) but requires regenerating all certificates.

Set up proactive monitoring to alert before certificates expire. Run kubeadm certs check-expiration monthly and alert if any certificate expires within 30 days.

Frequently asked questions

What does "Unable to connect to the server: x509: certificate has expired" mean?
This error occurs when Kubernetes is unable to establish a TLS connection with the API server because one or more certificates in the cluster have expired. 509 certificates for authentication and encryption between the kubectl client and the API server, between control plane components (API server, controller manager, scheduler), and between kubelet and the API server. When these certificates exceed their validity period (typically 1 year for kubeadm-created clusters), the cryptographic validation fails, blocking all cluster communication.
How do I fix "Unable to connect to the server: x509: certificate has expired"?
This error occurs when Kubernetes certificates have expired, preventing TLS connections between kubectl and the API server or between cluster components. Certificate renewal is required to restore cluster access.
What causes "Unable to connect to the server: x509: certificate has expired"?
kubeadm-generated certificates expired after the default 1-year validity period without cluster upgrade or manual renewal Kubernetes cluster was never upgraded, and no manual certificate renewal was performed in 12+ months Manual certificate rotation was incomplete; certificates were renewed on some control plane nodes but not others
Is the "Unable to connect to the server: x509: certificate has expired" error serious?
Yes. This is a critical-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading