RouterCertsDegraded for ARO operator

Question

RouterCertsDegraded for ARO operator

Nagashree 80

Hi Team

When I run oc get co on my cluster, I see below error for authentication operator:

RouterCertsDegraded: secret/<removed hostname by moderator> -n openshift-authentication: certificate could not validate route hostname <removed hostname by moderator>: x509: certificate has expired or is not yet valid: current time 2025-11-26T14:04:43Z is after 2025-06-05T14:49:36Z

But when I check secret (v4-0-config-system-router-certs) in openshift-authentication project, I can see it has not been expired:

Not Before: May 30 07:29:39 2025 GMT

Not After : May 30 07:29:40 2027 GMT

As troubleshoot we tried :

https://learn.microsoft.com/en-us/azure/openshift/howto-update-certificates

https://access.redhat.com/solutions/7071296

Please help to resolve this issue with solution

Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-11-28T14:13:56.5333333+00:00

Hello Nagashree

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-12-01T07:30:01.5033333+00:00

Hello Nagashree

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

1 answer

Your answer

Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-11-28T14:13:56.5333333+00:00

Hello Nagashree

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2025-12-01T07:30:01.5033333+00:00

Hello Nagashree

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Answer 1

Hello Nagashree

The RouterCertsDegraded condition occurs because the authentication operator validates the certificate chain served by the router for the oauth-openshift route.

The error shows Not After: 2025-06-05, meaning the router is presenting an expired certificate.
The secret v4-0-config-system-router-certs you checked is valid until 2027, but the router is not using that certificate or the bundle contains an expired cert first.
On Azure Red Hat OpenShift (ARO), the default ingress certificate is managed by the platform and rotates automatically. If rotation fails or gets stuck, the router continues to serve the old cert, causing this degraded status.
Firstly lets verify which certificate is actually served

host=oauth-openshift.apps.<apps-domain>
openssl s_client -connect ${host}:443 -servername ${host} -showcerts </dev/null \

If not after shows 2025-06-05, the router is using an expired platform cert.
If it shows your custom cert (valid until 2027).

As this step resolved the issue earlier to you Refresh ARO-managed certificates:

az aro update \
  --name <ClusterName> \

Reference link
https://learn.microsoft.com/en-us/azure/openshift/howto-update-certificates

If using a custom ingress certificate check which secret the router uses:

oc -n openshift-ingress-operator get ingresscontroller default \
  -o jsonpath='{.spec.defaultCertificate.name}{"\n"}'

oc -n openshift-ingress get secret <SECRET_NAME> -o jsonpath='{.data.tls\.crt}' \
 | base64 -d | openssl x509 -noout -text | egrep 'Subject:|Issuer:|Not Before|Not After'

Ensure:

First cert = wildcard for *.apps.<cluster-domain>.
Remove expired certs from the PEM chain.
Patch the router if needed

oc patch ingresscontroller.operator default \
  -n openshift-ingress-operator \
  --type=merge \
  -p '{"spec":{"defaultCertificate":{"name":"<SECRET_NAME>"}}}'

Restart the router

oc -n openshift-ingress delete pod -l ingresscontroller.operator.openshift.io/deployment-ingresscontroller=default

Check the certificate again with openssl s_client.

oc get co authentication

Root cause: Router is serving an expired certificate (platform cert not rotated or custom bundle misconfigured).
Fix:
- For platform certs → run az aro update.
- For custom certs → verify secret, correct bundle order, patch ingresscontroller, restart router pods.

Reference

https://access.redhat.com/solutions/7009467

If you have any questions please revert back we will be happy to assist you.

Thanks,
Manish Deshpande.