--- title: Amazon EKS now supports certificate authority (CA)... description: Amazon EKS now supports certificate authority rotation with a managed lifecycle and automated safeguards. Each EKS cluster has its own CA for encrypted API... canonical: https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management | daily.dev og:description: Amazon EKS now supports certificate authority rotation with a managed lifecycle and automated safeguards. Each EKS cluster has its own CA for encrypted API... og:url: https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk og:image: https://api.daily.dev/og/posts/AnUKHuTjk.png og:image:alt: Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management **[AWS](https://daily.dev/sources/aws)** · 2 min read · 1 upvotes · 0 comments ## Summary Amazon EKS now supports certificate authority rotation with a managed lifecycle and automated safeguards. Each EKS cluster has its own CA for encrypted API connections, and clusters created since 2018 have 10-year CA validity periods that are now approaching rotation time. AWS handles the rotation lifecycle and updates AWS-managed components automatically, including EKS Auto Mode and Fargate nodes, while customers must replace worker nodes and update external clients to trust the successor CA. Safeguards include advance expiration notifications, automatic successor CA creation if customers don't act, automatic activation on a default schedule, and rollback capability. The feature is available at no additional cost across all commercial AWS Regions via AWS CLI, EKS APIs, CloudFormation, and the console. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does certificate authority rotation work in Amazon EKS? Amazon EKS now manages a CA rotation lifecycle for clusters, automatically updating AWS-managed components to trust the successor CA. Customers must replace worker nodes and update external clients to trust the new CA before activation. Safeguards include advance expiration notices, automatic successor CA creation if the customer hasn't made one, automatic activation on a default schedule, and rollback to the previous CA if problems occur. _daily.dev helps platform teams track new AWS lifecycle features like EKS CA rotation before certificates expire._ ### Why do older Amazon EKS clusters need certificate authority rotation now? Amazon EKS clusters created since the service launched in 2018 were issued CAs with a 10-year validity period, so clusters from that era are now approaching the point where rotation should begin. Left unaddressed, an expired CA would disrupt encrypted connections to the cluster's Kubernetes API server, so EKS provides automated rotation with notifications and safeguards to keep clusters operational. _Engineers maintaining long-running EKS clusters can stay ahead of certificate expiration deadlines via daily.dev._ ### Do EKS Auto Mode and Fargate nodes need manual updates during CA rotation? No, EKS Auto Mode instances and AWS Fargate nodes are updated automatically by AWS during certificate authority rotation. However, customers remain responsible for updating any external clients that connect to the cluster's API server to trust the successor CA before it activates, since that part of the shared responsibility model is not automated. _daily.dev keeps engineers weighing managed versus self-managed EKS node options informed on operational trade-offs._ ## Similar posts on daily.dev - [Automate public TLS certificate issuance with ACME support in AWS Certificate Manager](https://daily.dev/posts/automate-public-tls-certificate-issuance-with-acme-support-in-aws-certificate-manager-i2i3oggwu) · AWS · 0 upvotes · 0 comments - [AWS Announces New Amazon EKS Capabilities to Simplify Workload Orchestration](https://daily.dev/posts/aws-announces-new-amazon-eks-capabilities-to-simplify-workload-orchestration-yjjaiucnz) · InfoQ · 3 upvotes · 0 comments - [AWS Certificate Manager now supports the ACME protocol for public certificates](https://daily.dev/posts/aws-certificate-manager-now-supports-the-acme-protocol-for-public-certificates-kehj4conk) · AWS · 0 upvotes · 0 comments - [AWS deprecated this EKS auth method. 81% of clusters still run it.](https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv) · The New Stack · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management","url":"https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk"},"datePublished":"2026-08-20T20:51:22.552Z","dateModified":"2026-09-13T21:59:37.037Z","description":"Amazon EKS now supports certificate authority rotation with a managed lifecycle and automated safeguards. Each EKS cluster has its own CA for encrypted API...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2d99c2aecc14a73a5cba88addc902c88?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2d99c2aecc14a73a5cba88addc902c88?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,kubernetes","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk#faq","mainEntity":[{"@type":"Question","name":"How does certificate authority rotation work in Amazon EKS?","acceptedAnswer":{"@type":"Answer","text":"Amazon EKS now manages a CA rotation lifecycle for clusters, automatically updating AWS-managed components to trust the successor CA. Customers must replace worker nodes and update external clients to trust the new CA before activation. Safeguards include advance expiration notices, automatic successor CA creation if the customer hasn't made one, automatic activation on a default schedule, and rollback to the previous CA if problems occur. daily.dev helps platform teams track new AWS lifecycle features like EKS CA rotation before certificates expire."}},{"@type":"Question","name":"Why do older Amazon EKS clusters need certificate authority rotation now?","acceptedAnswer":{"@type":"Answer","text":"Amazon EKS clusters created since the service launched in 2018 were issued CAs with a 10-year validity period, so clusters from that era are now approaching the point where rotation should begin. Left unaddressed, an expired CA would disrupt encrypted connections to the cluster's Kubernetes API server, so EKS provides automated rotation with notifications and safeguards to keep clusters operational. Engineers maintaining long-running EKS clusters can stay ahead of certificate expiration deadlines via daily.dev."}},{"@type":"Question","name":"Do EKS Auto Mode and Fargate nodes need manual updates during CA rotation?","acceptedAnswer":{"@type":"Answer","text":"No, EKS Auto Mode instances and AWS Fargate nodes are updated automatically by AWS during certificate authority rotation. However, customers remain responsible for updating any external clients that connect to the cluster's API server to trust the successor CA before it activates, since that part of the shared responsibility model is not automated. daily.dev keeps engineers weighing managed versus self-managed EKS node options informed on operational trade-offs."}}]} ```