RouterCertsDegraded

Question

RouterCertsDegraded

Nagashree 80

Hi Team

When I run oc get co on my cluster, I see below error saying

RouterCertsDegraded: secret/v4-0-config-system-router-certs.spec.data[apps.xxx-xxx.arocluster.net] -n openshift-authentication: certificate could not validate route hostname oauth-openshift.apps.xxx-xxx.arocluster.net: x509: certificate has expired or is not yet valid: current time 2025-10-14T11:17:33Z is after 2025-06-05T14:49:36Z

But when I check secret (v4-0-config-system-router-certs) in openshift-authentication project, I can see it has not been expired:
Not Before: May 30 07:29:39 2025 GMT

Not After : May 30 07:29:40 2027 GMT

What is the cause of this error, and is there a solution available? Since this involves ARO, is Azure responsible for resolving the issue?

Nagashree 80 Reputation points

2025-10-23T12:04:02.2266667+00:00

Thanks for answering Manish.
So what will be impact because of this RouterCertsDegraded.
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-10-23T14:08:21.9666667+00:00

Hello Nagashree.

If the cluster certificate update process is not completed successfully, the system may continue to indicate that the certificate has expired.

Kindly let us know if the above helps or you need further assistance on this issue.
Nagashree 80 Reputation points

2025-10-24T05:49:05.7433333+00:00

Hi Manish

What is the rollback plan after execution of az aro update --name MyCluster --resource-group MyResourceGroup command ?
Nagashree 80 Reputation points

2025-10-31T07:43:42+00:00

Hi Team,

Any thoughts on my issue
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-11-05T13:16:02.5266667+00:00

Hello Nagashree

There is no direct rollback command for az aro update. This operation updates the cluster certificates and restarts worker nodes to restore the cluster to a healthy state. Once executed, the changes cannot be automatically reverted.

Important: Azure Red Hat OpenShift does not support an automated rollback for certificate updates. Manual redeployment is the only full rollback option.

Reference: Update Certificates in ARO

2 answers

Your answer

Nagashree 80 Reputation points

2025-10-23T12:04:02.2266667+00:00

Thanks for answering Manish.
So what will be impact because of this RouterCertsDegraded.
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-10-23T14:08:21.9666667+00:00

Hello Nagashree.

If the cluster certificate update process is not completed successfully, the system may continue to indicate that the certificate has expired.

Kindly let us know if the above helps or you need further assistance on this issue.
Nagashree 80 Reputation points

2025-10-24T05:49:05.7433333+00:00

Hi Manish

What is the rollback plan after execution of az aro update --name MyCluster --resource-group MyResourceGroup command ?
Nagashree 80 Reputation points

2025-10-31T07:43:42+00:00

Hi Team,

Any thoughts on my issue
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-11-05T13:16:02.5266667+00:00

Hello Nagashree

There is no direct rollback command for az aro update. This operation updates the cluster certificates and restarts worker nodes to restore the cluster to a healthy state. Once executed, the changes cannot be automatically reverted.

Important: Azure Red Hat OpenShift does not support an automated rollback for certificate updates. Manual redeployment is the only full rollback option.

Reference: Update Certificates in ARO

Answer 1

Hello Nagashree

Welcome to Microsoft Q&A.

The RouterCertsDegraded error indicates a problem with router certificates in your OpenShift cluster. Although the error message suggests that the certificate has expired, the actual certificate stored in the openshift-authentication secret remains valid until "May 30, 2027".
This discrepancy typically occurs when the cluster’s automatic certificate update process fails. Normally, certificates are refreshed during routine maintenance, but if the update process does not complete successfully, the system may continue to report an expired certificate even though it is still valid.
To restore your cluster to a healthy state, you can manually update the certificates using the Azure CLI:

Open Azure Cloud Shell.
Run the following command:

az aro update --name MyCluster --resource-group MyResourceGroup

Running this command will:

Restart the worker machines.
Update the cluster certificates.
Return the cluster to a stable, known state.

Azure Red Hat OpenShift manages infrastructure and certificate maintenance automatically. However, if the automated process fails, manual intervention ensures that certificates are correctly updated and the cluster continues to operate as expected.

Reference link - https://learn.microsoft.com/en-us/azure/openshift/howto-update-certificates

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,
Manish Deshpande.

Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-11-05T13:17:18.8033333+00:00

Hello Nagashree

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Nagashree 80

Hi Team,

az aro update --name MyCluster --resource-group MyResourceGroup

Didnot fix the issue.

Then we followed- https://access.redhat.com/solutions/7071296
But still we have same issue

Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-12-05T19:45:13.2566667+00:00
Hello Nagashree

https://access.redhat.com/solutions/7009467The RouterCertsDegraded condition occurs because the authentication operator validates the certificate chain served by the router for the oauth-openshift route.

The error shows Not After: 2025-06-05, meaning the router is presenting an expired certificate.

The secret v4-0-config-system-router-certs you checked is valid until 2027, but the router is not using that certificate or the bundle contains an expired cert first.

On Azure Red Hat OpenShift (ARO), the default ingress certificate is managed by the platform and rotates automatically. If rotation fails or gets stuck, the router continues to serve the old cert, causing this degraded status.

Firstly lets verify which certificate is actually served

Azure PowerShell

host=

If not after shows 2025-06-05, the router is using an expired platform cert.

If it shows your custom cert (valid until 2027).

As this step resolved the issue earlier to you Refresh ARO-managed certificates:

Azure PowerShell

az aro update \

Reference link
https://learn.microsoft.com/en-us/azure/openshift/howto-update-certificates

If using a custom ingress certificate check which secret the router uses:

Azure PowerShell

oc

Azure PowerShell

oc

Ensure:

First cert = wildcard for *.apps.<cluster-domain>.

Remove expired certs from the PEM chain.

Patch the router if needed

Azure PowerShell

oc patch ingresscontroller.operator default \

Restart the router

Azure PowerShell

oc

Check the certificate again with openssl s_client.

Azure PowerShell

oc get co authentication

Root cause: Router is serving an expired certificate (platform cert not rotated or custom bundle misconfigured).

Fix:

For platform certs → run az aro update.

For custom certs → verify secret, correct bundle order, patch ingresscontroller, restart router pods. ```Reference [https://access.redhat.com/solutions/7009467](https://access.redhat.com/solutions/7009467) I have pinged this details on the new thread which you created. Thanks, Manish Deshpande.
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-12-09T18:50:59.2566667+00:00

Hello Nagashree

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-12-11T19:21:27.71+00:00

Hello Nagashree

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.