Docs

Volcengine Kubernetes Engine

LoadBalancer

Updating HTTPS certificates for LoadBalancer services

When configuring an HTTPS listener for a LoadBalancer service, you can update the listener's certificate via annotation or the certificate center. This topic introduces how to update certificate configurations for HTTPS listeners upon expiration or rotation.

Background

In VKE, you can annotate a LoadBalancer-type service to create and manage an HTTPS listener automatically for the instance. The HTTPS listener binds a certificate for server authentication and data encryption, ensuring secure HTTPS connections for client access. For details, see the following documentation:

Configuring CLB LoadBalancer Services by using annotations

Configuring an NLB Service using annotations

HTTPS certificates typically have a fixed validity period. After expiration, if the listener still uses the old certificate, clients may see expiration warnings, security alerts, or connection failures. Thus, before expiration, you need to apply, upload, or prepare a new certificate and update the listener's HTTPS certificate promptly.

The update method depends on the source of the certificate. The following table provides details.

Configuration method	Certificate source	Certificate update method
Specify the certificate ID using an annotation	CLB certificate	Manual update.
Specify the certificate ID using an annotation		Certificates from Certificate Center	Manual update. Batch update and deployment are allowed when working with Certificate Center.

Manual certificate update

warning

For manual updates, do not replace the certificate directly in the LoadBalancer console's listener page. When the rules change on VKE, the listener will be reconciled to the old certificate, potentially causing service disruptions.

Procedure

On the Cluster page, click the name of the target cluster to go to the cluster management page.

In the left navigation pane, select Services and Ingresses > Service, select the target service, and click Edit Yaml in the Actions column on the right.

In the annotation section of the YAML content, replace the old certificate ID with the new one.

Click Confirm.

Validate results

After the update succeeds, you can log in to the CLB console to verify the listener's bound certificate. This topic uses CLB LoadBalancer as an example.

After configuration, click the service name, go to the Event tab, and check the reconciliation success events.

Log in to the LoadBalancer console , check the certificate details of the listener, and confirm the replacement of the certificate ID.

Update certificates via Certificate Center

Usage limits

Only resources using certificates from Certificate Center support batch update and deployment.

The account used to update certificates in Certificate Center must have write permissions on VKE cluster resources. For example, in this topic, write permission for service resources is required.

Procedure

We recommend managing certificates via Certificate Center. This section focuses on using the Deploy feature in the Center for batch updates.

Purchase or upload a new SSL certificate. For details, see Creating SSL certificate order and Uploading SSL certificate.

In the left navigation pane, select SSL Certificate > Certificates.

In the certificate list, select the new certificate and click Deploy in the Actions column to go to the deployment page.

In Deploy to, select VKE, then select the region and resources in Resource list and add them to the Pending deployment list on the right.

Click Deploy, confirm the deployment, and the certificate deployment will begin.

Validate results

After the update succeeds, you can log in to the CLB console to verify the listener's bound certificate. This topic uses CLB LoadBalancer as an example.

Upon completion, the system will show Succeeded in the Deployment status.

Last updated: 2026.08.10 14:25:55