Docs

Volcengine Kubernetes Engine

CLB Ingress

Updating HTTPS certificates for CLB Ingress

When an HTTPS certificate for a cluster is about to expire, update it promptly to ensure uninterrupted HTTPS access. After expiration, clients will see certificate invalidity warnings, which may cause service unavailability in severe cases. This topic describes how to update HTTPS certificates for CLB Ingress in VKE.

Certificate update methods

The update method depends on the source of the certificate. As shown in the table below.

Configuration method	Certificate source	Certificate update method
Use the Secret that contains the certificate ID	CLB certificate	Manual update.
Use the Secret that contains the certificate ID		Certificates from Certificate Center	Manual update. Batch update and deployment are allowed when working with Certificate Center.

Manual update of certificates

warning

When CLB Ingress uses HTTPS, do not replace the certificate manually in the CLB console's listener page. When the Ingress rules change on VKE, the listener will be reconciled to the old certificate, potentially causing service disruptions.

Procedure

Log in to the LoadBalancer console or Certificate Center console to purchase or upload a new certificate. For details, see Certificate management, Creating SSL certificate, and Uploading SSL certificate.

On the Cluster page, click the name of the target cluster to go to the cluster management page.

In the left navigation bar, click Services and Ingresses > Ingress. In the Ingress list, find the Ingress for which you need to update the HTTPS certificate and click Update in the Actions column.

In Listener configuration, select the certificate source and click Create Secret.

Configure the Secret based on the selected certificate source.

CLB certificate
Certificates from Certificate Center

When using a CLB certificate, select CLB as the certificate source, and choose the new certificate in the Server Certificate drop-down menu.

Select the newly created Secret.

Click Confirm to complete the Ingress update.

Validate results

After configuration, click the Ingress name, go to the Event tab, and check the reconciliation success event.

Log in to the LoadBalancer console, check the certificate details of the listener, and confirm the replacement of the certificate ID.

Update certificates via Certificate Center

Usage limits

Only resources using certificates from Certificate Center support batch update and deployment.

The account used to update certificates in Certificate Center must have write permissions on VKE cluster resources. For example, in this topic, write permission for CLB Ingress is required.

Procedure

We recommend managing certificates via Certificate Center. This section focuses on using the Deploy feature in the Center for batch updates.

Purchase or upload a new SSL certificate. For details, see Creating SSL certificate order and Uploading SSL certificate.

In the left navigation pane, select SSL Certificate > Certificates.

In the certificate list, select the new certificate and click Deploy in the Actions column to go to the deployment page.

In Deploy to, select VKE, then select the region and resources in Resource list and add them to the Pending deployment list on the right.

Click Deploy, confirm the deployment, and the certificate deployment will begin.

Validate results

Upon completion, the system will show Succeeded in the Deployment status.

Last updated: 2026.08.10 14:25:55