> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/galera-cluster/galera-security/routine-certificate-rotation.md).

# Routine Certificate Rotation

Node certificates should be replaced before they expire. Because certificates can be reloaded without a restart (see [Reloading TLS Certificates Without Downtime](/docs/galera-cluster/galera-security/reloading-tls-certificates-without-downtime.md)), routine rotation needs no coordinated downtime.

{% hint style="info" %}
To know when a node is approaching expiry, set [wsrep\_certificate\_expiration\_hours\_warning](/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security.md#certificate-expiration-warnings). MariaDB Enterprise Cluster then logs a warning to the error log a configurable number of hours before the node's TLS certificate expires — use it to trigger rotation ahead of time.
{% endhint %}

## Procedure

1. Issue a new certificate for each node from the **same cluster CA**, with a validity period that overlaps the current certificate (the new certificate should be valid before the old one expires).
2. Distribute each node's new certificate and key to that node.
3. On one node at a time, replace the files at their configured paths and run `FLUSH SSL;`.
4. Confirm the node is serving the new certificate and remains `Synced`.
5. Repeat for each node.

{% hint style="info" %}
Keeping certificate lifetimes short is practical precisely because rotation is online. See [Choosing a Certificate Authority for Galera Cluster](/docs/galera-cluster/galera-security/choosing-a-certificate-authority-for-galera-cluster.md).
{% endhint %}

## See Also

* [Reloading TLS Certificates Without Downtime](/docs/galera-cluster/galera-security/reloading-tls-certificates-without-downtime.md)
* [Cluster CA Rotation](/docs/galera-cluster/galera-security/cluster-ca-rotation.md)
* [Responding to a Key or Certificate Compromise](/docs/galera-cluster/galera-security/responding-to-a-key-or-certificate-compromise.md)

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>