---
title: How to Renew Envoy Pod TLS Certificates
slug: turbine-installer/how-to-renew-envoy-pod-tls-certificates
docTags: 
createdAt: 2025-12-12T11:35:13.679Z
---

One year after a Swimlane SPI installation, the envoy pod self-signed TLS certificate created during the installation will expire. A feature to auto-renew these certs at thirty days prior to expiration is available on Embedded SPI (10.5.0\_295+) running ekco 0.16.0+. 

To check the version of ekco, run:

:::BlockQuote
kubectl get installers swimlane-platform -o jsonpath="\{.spec.ekco.version}" && echo
:::

For older versions, manually create a new envoy pod TLS certificate using the following instructions.

**Step 1: Confirm the Envoy Pod TLS Certificate Expiration Date**

Run this command to see the current envoy pod certificate expiration date:

:::BlockQuote
for pod in $(kubectl get pods -n projectcontour -l app=envoy -o=name)
do
   echo $pod
   echo ===============
   echo ca.crt:
   kubectl exec $pod -n projectcontour -c envoy -- openssl x509 -enddate -noout -in /certs/ca.crt
   echo tls.crt:
   kubectl exec $pod -n projectcontour -c envoy -- openssl x509 -enddate -noout -in /certs/tls.crt
done
:::

The output will look similar to:

:::BlockQuote
pod/envoy-9rct8
\===============
ca.crt:
notAfter=Dec 10 20:58:33 2021 GMT
tls.crt:
notAfter=Dec 10 20:58:33 2021 GMT
:::


**Step 2: Renew the Envoy Pod TLS Certificate**

(These instructions need only be performed once, regardless of the number of cluster nodes.)

:::BlockQuote
\# Delete the "envoycert" secret
kubectl delete secret envoycert -n projectcontour

\# Delete the job
kubectl delete jobs -n projectcontour contour-certgen-v1.7.0

\# Download the attached "contour-certgen-v1.7.0.yaml" file and apply it to the cluster. 
kubectl apply -f contour-certgen-v1.7.0.yaml

\# Restart envoy
kubectl rollout restart -n projectcontour daemonset/envoy
kubectl rollout restart -n projectcontour deploy/contour
:::


**Step 3: Check Kubernetes certificates expiration dates and renew if necessary**
Follow the steps outlined in How to renew certificates on Kubernetes



::File{src="https://api.archbee.com/api/presign/n8uUzk0MM4uC57-zlHNtY/TKrSazQDBVCs5rTgpdDwX-20251212-114026.yaml" label="contour-certgen-v1.7.0.yaml"}