# Question: Does PXC Operator renew TLS certificate that automatically generated by the operator itself? **URL:** \ **Category:** Percona Operator for MySQL\ **Tags:** percona\ **Created:** [September 13, 2024, 3:44pm UTC](https://forums.percona.com/t/question-does-pxc-operator-renew-tls-certificate-that-automatically-generated-by-the-operator-itself/33128 "2024-09-13T15:44:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![chhatra](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chhatra](https://forums.percona.com/u/chhatra)\ **Post date:** [September 13, 2024, 3:44pm UTC](https://forums.percona.com/t/question-does-pxc-operator-renew-tls-certificate-that-automatically-generated-by-the-operator-itself/33128/1 "2024-09-13T15:44:41Z")
Hi, thank you for providing a very powerful database operator in k8s. I am quite new to PXC and the operator. Please kindly give me some light. Our PXC cluster was deployed to k8s via Percona Operator (percona-xtradb-cluster-operator:1.14.0). Everything is great. However, I am not clear about the behavior of the TLS certificate that was automatically generated by the operator itself. 1. We do not have a cert-manager in our k8s. We also did not create our own custom tls certificate. So the operator created a 1-year-expiration CA & TLS certificate. In this case, will the operator renew the CA & TLS certificate by itself (without downtime I assume)? 2. If I were to later on add the cert-manager to our k8s, will the operator use cert-manager to renew the existing operator-self-generated CA&TLS certificate with cert-manager when it is about to expire? Please kindly give me some light on how to proceed. ---
**Author:** ![Yunus](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yunus/32/6430_2.png) [@Yunus](https://forums.percona.com/u/Yunus)\ **Post date:** [September 13, 2024, 4:49pm UTC](https://forums.percona.com/t/question-does-pxc-operator-renew-tls-certificate-that-automatically-generated-by-the-operator-itself/33128/2 "2024-09-13T16:49:32Z")
Hi Chhatra, You should check this document about updating certs , > **[Percona Operator for MySQL - Transport Encryption (TLS/SSL)](https://docs.percona.com/percona-operator-for-mysql/pxc/TLS.html#installation-of-the-cert-manager)** > > The Percona Operator for MySQL uses Transport Layer > Security (TLS) cryptographic protocol for the following types of communication: ---
**Author:** ![chhatra](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chhatra](https://forums.percona.com/u/chhatra)\ **Post date:** [September 13, 2024, 11:47pm UTC](https://forums.percona.com/t/question-does-pxc-operator-renew-tls-certificate-that-automatically-generated-by-the-operator-itself/33128/3 "2024-09-13T23:47:13Z")
Hi @Yunus Thank you for kindly checking with my questions. I have read the document a lot of time now. It did only mentioned the need to update the TLS certificate if “there is no cert-manager” and “we created custom certificates by ourselves”. There is no mentioned of the need to update the TLS certificate if it was automatically created by the operator itself. So, I really can’t tell if I need to do the update. The other thing is the document did not mention what happens if later on we install the cert-manager to the cluster after pxc was created. Will the next certificate renewal by operator done using cert-manager instead? I could also read source code and etc. Please kindly point me to the right direct to confirm this. ---
**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\ **Post date:** [September 16, 2024, 8:30am UTC](https://forums.percona.com/t/question-does-pxc-operator-renew-tls-certificate-that-automatically-generated-by-the-operator-itself/33128/4 "2024-09-16T08:30:22Z")
> [@chhatra](#): > > - We do not have a cert-manager in our k8s. We also did not create our own custom tls certificate. So the operator created a 1-year-expiration CA & TLS certificate. In this case, will the operator renew the CA & TLS certificate by itself (without downtime I assume)? The Operator will not automatically renew the certificate. It is also not recommended to use Operator-generated certificate in production. > [@](#): > > - If I were to later on add the cert-manager to our k8s, will the operator use cert-manager to renew the existing operator-self-generated CA&TLS certificate with cert-manager when it is about to expire? What cert-manager does it taking care of certificate renewals and put it into the Secret. What Operator does is reading the Secret and applying it. So once cert-manager updates the Secret resource, Operator will make sure the cert is updated for your cluster. Hope this helps. ---
**Author:** ![chhatra](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chhatra](https://forums.percona.com/u/chhatra)\ **Post date:** [September 17, 2024, 12:29pm UTC](https://forums.percona.com/t/question-does-pxc-operator-renew-tls-certificate-that-automatically-generated-by-the-operator-itself/33128/5 "2024-09-17T12:29:29Z")
Hi @Sergey_Pronin Thank you for your helps. I think the information is clearer now. I will try to test it out and share it here again. Thank you.