---
title: Upload new TLS certificate for the KOTS admin page
slug: turbine-installer/upload-new-tls-certificate-for-the-kots-admin-page
docTags: 
createdAt: 2025-12-09T17:17:39.991Z
---

If you've already gone through the setup process once, and you want to upload new TLS certificates, run this command to restore the ability to upload new TLS certificates:

:::BlockQuote
kubectl -n default annotate secret kotsadm-tls acceptAnonymousUploads=1
:::

Adding this annotation will temporarily create a vulnerability for an attacker to maliciously upload TLS certificates. Once TLS certificates have been uploaded then the vulnerability is void.

After adding the annotation, you will need to restart the kurl proxy server. The simplest way is to delete the kurl-proxy pod (the pod will automatically get restarted):

:::BlockQuote
kubectl delete pods PROXY\_SERVER
:::

The following command will provide the name of the kurl-proxy server:

:::BlockQuote
kubectl get pods -A | grep kurl-proxy | awk '\{print $2}'
:::

After the pod has been restarted, direct your browser to \<http\://\<ip>:8800> and run through the upload process.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/3itBHK3v_tazsY7TlUbMA_image.png)

It's best to complete this process as soon as possible to avoid anyone from nefariously uploading TLS certificates. After this process has completed, the vulnerability will be closed, and uploading new TLS certificates will be disallowed again. Please repeat the steps above in order to upload new TLS certificates.