Replacing expired certificates

It might be the case that your issuer certificate is expired. If this it true running linkerd check --proxy will produce output similar to:

Replacing the root and issuer certificates

If your root certificate is expired or you do not have its key, you need to replace both your root and issuer certificates at the same time. If your root has expired linkerd check will indicate that by outputting an error similar to:

Usually upgrade will prevent you from using an issuer certificate that will not work with the roots your meshed pods are using. At that point we do not need this check as we are updating both the root and issuer certs at the same time. Therefore we use the --force flag to ignore this error.

Additionally you can use the kubectl rollout restart command to bring the configuration of your other injected resources up to date, and then the check command should stop producing warning or errors: