Cisco Catalyst Center Administrator Guide, Release 3.2.x

Renew internal certificates

Updated: May 5, 2026

Want to summarize with AI?

Overview

Information about renewing internal certificates for another year before they are set to expire.

Catalyst Center uses a number of certificates, such as the ones generated by Kubernetes and the ones used by Kong and Credential Manager Services. These certificates are valid for one year, which starts as soon as you install your cluster. Catalyst Center automatically renews these internal certificates for another year before they are set to expire.

We recommend that you renew internal certificates before they expire, not after.
You can only renew internal certificates that are set to expire up to 100 days from now. This procedure does not do anything to certificates that will expire later than that.
The script refreshes only self-signed certificates, not third-party/certificate authority (CA)-signed certificates. For third-party/CA-signed certificates, the script updates the internal certificates used by Kubernetes and the Credential Manager.
For self-signed certificates, the renewal process does not require you to push certificates back out to devices, because the root CA is unchanged.
The term cluster applies to both single-node and three-node Catalyst Center setups.

Procedure

	1.	Ensure that each cluster node is healthy and not experiencing any issues.
	2.	To view a list of the certificates that are currently used by that node and their expiration date, enter this command: `sudo maglev-config certs info`
	3.	Renew the internal certificates that are set to expire soon by entering this command: `sudo maglev-config certs refresh`
	4.	Repeat the preceding steps for the other cluster nodes.
	5.	For utility help, enter: `$ sudo maglev-config certs --help Usage: maglev-config certs [OPTIONS] COMMAND [ARGS]... Options: --help Show this message and exit. Commands: info refresh`

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.