How to Check the Sunpike and Cluster Certificate Details?

Problem

  • How to Check the Sunpike and Cluster Certificate Details in LTS1 setup.

Environment

  • Platform9 Edge Cloud - v-5.3.

Procedure

Sunpike Certificates

  • Use below mentioned steps to check the TTL value of Sunpike CA.

# export VAULT_TOKEN=$(mysql qbert -Bse "SELECT credential_value FROM qbert_secrets where credential_name='root_token'")
# export VAULT_ADDR=http://127.0.0.1:8200
# /usr/local/bin/vault read pki/roles/sunpike | grep ttl
max_ttl 8760h ttl

  • Use below mentioned steps to check the certificate of Sunpike:

vault read pki/cert/ca -format=json | jq -r '.data.certificate'

  • Use below mentioned steps to check the certificate of Sunpike:

# docker exec -ti sunpike-kube-apiserver /bin/bash
# curl -kv https://127.0.0.1:6443

Cluster Certificates

  • Use below mentioned steps to check the TTL value of Cluster CA.

# cat /etc/vault/server.hcl | grep ttl
Or
# cat /etc/pf9-vault.d/server-config.hcl | grep ttl

  • Use below mentioned steps to check the certificate of Sunpike:

# export VAULT_TOKEN=$(mysql qbert -Bse "SELECT credential_value FROM qbert_secrets where credential_name='root_token'")
# export VAULT_ADDR=http://127.0.0.1:8200

# /usr/local/bin/vault read pki/cert/ca -format=json | jq -r '.data.certificate' > ca.cert
# cat ca.cert | openssl x509 -noout -dates

  • To know the current cluster certificate expiry you can try below steps:

# openssl x509 -in /etc/pf9/kube.d/certs/kubelet/apiserver/request.crt -text -noout


© 2025 Platform9. All Rights Reserved

On This Page
How to Check the Sunpike and Cluster Certificate Details?ProblemEnvironmentProcedure