Docs

Volcengine Kubernetes Engine

Certificate and security

Updating HTTPS certificates for ALB Ingress

When an HTTPS certificate for a cluster is about to expire, update it promptly to ensure uninterrupted HTTPS access. After expiration, clients will see certificate invalidity warnings, which may cause service unavailability in severe cases. This topic describes how to update HTTPS certificates for ALB Ingress in VKE.

Certificate update methods

The update method varies depending on how the certificate is configured and where it comes from. For more details, see Configuring HTTPS certificates for ALB Ingress.

Configuration method	Certificate source	Certificate update method
Use the Secret that contains the certificate ID	ALB certificates	Manual update.
Use the Secret that contains the certificate ID		Certificates from Certificate Center	Manual update. Batch update and deployment are allowed when working with Certificate Center.
Using a Secret of type TLS that contains the certificate content.	For certificates obtained from other sources (such as other certificate authorities or those created using OpenSSL), enter the certificate information in the Secret. The system will upload it to the certificate center for storage.	Manual update.
Use an ALBInstance to specify a certificate	ALB certificates	Manual update.
Use an ALBInstance to specify a certificate		Certificates from Certificate Center	Manual update. Batch update and deployment are allowed when working with Certificate Center.

Manual update of certificates

warning

When replacing a certificate, do not perform the replacement directly in the ALB console's listener page. When the Ingress rules change on VKE, the listener will be reconciled to the old certificate, potentially causing service disruptions.

Procedure

Log in to the ALB console or Certificate Center to purchase or upload a new certificate. For details, see Uploading SSL certificates and Managing certificates.

On the Cluster page, click the name of the target cluster to go to the cluster management page.

In the left navigation bar, click Services and Ingresses > Ingress. In the Ingress list, find the Ingress for which you need to update the HTTPS certificate and click Update in the Actions column.

In Listener configuration, select the certificate source and click Create Secret.

Configure the Secret based on the selected certificate source.

ALB certificates
Certificates from Certificate Center
TLS certificate

When using an ALB certificate, select ALB as the certificate source, and choose the new certificate in the Server Certificate drop-down menu.

Select the newly created Secret.

Click Confirm to complete the Ingress update.

Validate results

After configuration, click the Ingress name, go to the Event tab, and check the reconciliation success event.

Update certificates via Certificate Center

tip

We recommend managing certificates via Certificate Center. This section focuses on using the Deploy feature in the Center for batch updates.

Usage limits

Only resources using certificates from Certificate Center support batch update and deployment.

The account performing certificate deployment must have write permissions on target VKE cluster resources, such as ALB Ingress and Secret. Insufficient permissions may prevent resource selection or deployment submission.

Procedure

Purchase or upload a new SSL certificate. For details, see Creating SSL certificate order and Uploading SSL certificate.

In the left navigation pane, select SSL Certificate > Certificates.

In the certificate list, select the new certificate and click Deploy in the Actions column to go to the deployment page.

In Deployment platform, select VKE, then select the region, cluster, and namespace in Resource List, tick the target resources, and add them to Pending Deployment List on the right.

Click Deploy, confirm the deployment, and the certificate deployment will begin.

Validate results

Upon completion, the system will show Succeeded in the Deployment status.

Last updated: 2026.08.10 14:25:55