rancher 证书过期网页进不去 问题解决

参考文章：https://docs.rancher.cn/docs/rancher2.5/cluster-admin/certificate-rotation/_index/#%E6%A6%82%E8%BF%B0

一、问题故障描述：

查看 rancher 容器 日志

docker logs --tail 100 dfc1ef8e4f29

提示以下信息：

2024/05/07 08:49:58 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate has expired or is not yet valid: current time 2024-05-07T08:49:58Z is after 2023-08-12T12:40:53Z
time="2024-05-07T08:49:58.286554030Z" level=info msg="Waiting for master node  startup: resource name may not be empty"
2024-05-07 08:49:58.658786 I | http: TLS handshake error from 127.0.0.1:44498: remote error: tls: bad certificate
2024-05-07 08:49:58.660633 I | http: TLS handshake error from 127.0.0.1:44500: remote error: tls: bad certificate
time="2024-05-07T08:49:58.660725073Z" level=error msg="server https://127.0.0.1:6443/cacerts is not trusted: Get https://127.0.0.1:6443/cacerts: x509: certificate has expired or is not yet valid"
time="2024-05-07T08:49:59.286748842Z" level=info msg="Waiting for master node  startup: resource name may not be empty"
2024-05-07 08:50:00.214517 I | http: TLS handshake error from 127.0.0.1:44502: remote error: tls: bad certificate
2024/05/07 08:50:00 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate has expired or is not yet valid: current time 2024-05-07T08:50:00Z is after 2023-08-12T12:40:53Z
time="2024-05-07T08:50:00.286991654Z" level=info msg="Waiting for master node  startup: resource name may not be empty"
2024-05-07 08:50:00.662312 I | http: TLS handshake error from 127.0.0.1:44504: remote error: tls: bad certificate
2024-05-07 08:50:00.663978 I | http: TLS handshake error from 127.0.0.1:44506: remote error: tls: bad certificate
time="2024-05-07T08:50:00.664045071Z" level=error msg="server https://127.0.0.1:6443/cacerts is not trusted: Get https://127.0.0.1:6443/cacerts: x509: certificate has expired or is not yet valid"
time="2024-05-07T08:50:01.287238713Z" level=info msg="Waiting for master node  startup: resource name may not be empty"
2024/05/07 08:50:02 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate has expired or is not yet valid: current time 2024-05-07T08:50:02Z is after 2023-08-12T12:40:53Z
2024-05-07 08:50:02.216587 I | http: TLS handshake error from 127.0.0.1:44508: remote error: tls: bad certificate
time="2024-05-07T08:50:02.287535519Z" level=info msg="Waiting for master node  startup: resource name may not be empty"
2024-05-07 08:50:02.666576 I | http: TLS handshake error from 127.0.0.1:44510: remote error: tls: bad certificate
2024-05-07 08:50:02.668689 I | http: TLS handshake error from 127.0.0.1:44512: remote error: tls: bad certificate
time="2024-05-07T08:50:02.668753807Z" level=error msg="server https://127.0.0.1:6443/cacerts is not trusted: Get https://127.0.0.1:6443/cacerts: x509: certificate has expired or is not yet valid"

发现是因为提示证书过期 certificate has expired or is not yet valid

二、解决方法：

独立容器 Rancher Server 证书更新#

1. 证书未过期

证书未过期时，rancher server 可以正常运行。升级到 Rancher v2.0.14+ 、v2.1.9+、v2.2.2+ 后会自动检查证书有效期，如果发现证书即将过期，将会自动生成新的证书。所以独立容器运行的 Rancher Server，只需在证书过期前把 rancher 版本升级到支持自动更新 ssl 证书的版本即可，无需做其他操作。

2. 证书已过期

如果证书已过期，那么 rancher server 无法正常运行。即使升级到 Rancher v2.0.14+ 、v2.1.9+、v2.2.2+ 也可能会提示证书错误。如果出现这种情况，可通过以下操作进行处理：

正常升级 rancher 版本到 v2.0.14+ 、v2.1.9+、v2.2.2+；

执行以下命令：

• 2.0 或 2.1 版本

docker exec -ti <rancher_server_id> mv /var/lib/rancher/management-state/certs/bundle.json /var/lib/rancher/management-state/certs/bundle.json-bak

• 2.2 +

docker exec -ti <rancher_server_id> mv /var/lib/rancher/management-state/tls/localhost.crt /var/lib/rancher/management-state/tls/localhost.crt-bak

• 2.3 +

docker exec -ti <rancher_server_id> mv /var/lib/rancher/k3s/server/tls /var/lib/rancher/k3s/server/tlsbak

执行两侧，第一次用于申请证书，第二次用于加载证书并启动

docker restart <rancher_server_id>

• 2.4/2.5 +

exec 到 rancher server

kubectl --insecure-skip-tls-verify -n kube-system delete secrets k3s-serving
kubectl --insecure-skip-tls-verify delete secret serving-cert -n cattle-system
rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json

重启 rancher-server

执行以下命令刷新参数

curl --insecure -sfL https://<server-url>/v3  # 请将 <server-url> 替换为 Rancher Server 的访问地址

重启 Rancher Server 容器

docker restart <rancher_server_id>