Update custom Certificate Authority (CA) certificates

This section describes how to update the custom CA certificates that Istio uses for intra-cluster encryption in transit in some scenarios. You must always create a new full chain certificate file (cert-chain.pem).

Domino recommends backing up existing certificates and keys before updating new ones.

Scenario 1: No changes were made to the private key and common name This assumes only ca-cert.pem is updated. Create a secret with the new files and restart the Istio daemon (istiod).

# Delete existing secret with CA cert files
kubectl -n istio-system delete secret cacerts

# Create new secret with CA cert files
kubectl -n istio-system create secret generic cacerts
    --from-file=./ca-cert.pem
    --from-file=./ca-key.pem
    --from-file=./root-cert.pem
    --from-file=./cert-chain.pem

# Restarting all istiod pods
kubectl -n istio-system delete po -l app=istiod

Scenario 2: Updates were made to the private key, common name, or upstream certificates Changes made to the private key, common name (CN) or upstream certificates require that you recreate the cacerts secret and restart the Istio daemon.

# Delete existing secret with CA cert files
kubectl -n istio-system delete secret cacerts

# Create new secret with CA cert files
kubectl -n istio-system create secret generic cacerts
    --from-file=./ca-cert.pem
    --from-file=./ca-key.pem
    --from-file=./root-cert.pem
    --from-file=./cert-chain.pem

# Full restart for all Istio pods
for NS in istio-system domino-platform domino-compute; do
    kubectl -n $NS get po --no-headers -o custom-columns=name:metadata.name | xargs kubectl -n $NS delete po
done

Last modified on June 22, 2026

Architecture & deployment

Identity & access

Infrastructure & compute

Platform configuration

Data administration

Operations, monitoring & cost

Security & compliance

Update custom Certificate Authority (CA) certificates