Manage load balancer certificates

Upload a certificate and private key for HTTPS listeners, check its expiry, and renew it with the same key or a replacement key.

Prerequisites

The chain must contain the leaf certificate followed by any required intermediates, without the root CA certificate. The service accepts RSA keys of at least 2048 bits or ECDSA keys and validates the chain and key pair.

Replace fullchain.pem and privkey.pem in the commands below with the paths to your certificate chain and private key. Use the paths to your replacement files when renewing the certificate or replacing its key.

Create and upload a certificate

Create a certificate resource. You can use cert as an alias for certificate in CLI commands:

evroc loadbalancer certificate create web-cert

Creation makes an empty resource. Upload the certificate chain and key to make it usable:

evroc loadbalancer certificate upload web-cert \
  --certificate-file=fullchain.pem \
  --private-key-file=privkey.pem

Uploaded material is not returned by get or list.

Inspect readiness and expiry

List certificate resources or inspect a specific certificate:

evroc loadbalancer certificate list -o yaml
evroc loadbalancer certificate get web-cert -o json

Check status.conditions for Ready: True before using the certificate. Status also includes:

  • notBefore and notAfter: the certificate validity window
  • subject, issuer, and subjectAlternativeNames: certificate identity metadata
  • certificateSha256Fingerprint: the leaf certificate's SHA256 fingerprint
  • publicKeySha256Fingerprint: the private key's public-key SHA256 fingerprint

Use notAfter to schedule renewal before expiry. Certificate issuance and renewal scheduling are your responsibility. An upload success confirms that content was stored; wait for resource readiness before verifying serving behavior.

Renew using the same private key

Obtain a replacement certificate chain that matches the stored key, then upload only the chain:

evroc loadbalancer certificate renew web-cert \
  --certificate-file=renewed-fullchain.pem

Renewal retains the stored private key and requires an existing uploaded key. To use a different key, upload a complete pair instead.

Check readiness, notAfter, and certificateSha256Fingerprint after renewal. The public-key fingerprint stays the same when you reuse the key. Verify an HTTPS request as described in Create an HTTPS load balancer.

Replace the private key and certificate

Upload a complete matching pair to the existing resource:

evroc loadbalancer certificate upload web-cert \
  --certificate-file=replacement-fullchain.pem \
  --private-key-file=replacement-privkey.pem

Listeners referencing web-cert continue to reference that resource. Check readiness and both fingerprints, then verify an HTTPS request. You do not need to remove and recreate the listeners when replacing certificate content.

Delete a certificate

Remove listeners that reference the certificate before deleting it. For the listener in the HTTPS guide:

evroc loadbalancer loadbalancer removelistener web-lb --listener-name=https
evroc loadbalancer certificate delete web-cert

Next steps