# Extending Istio Self-Signed Root Certificate Lifetime

DevFeed: [Extending Istio Self-Signed Root Certificate Lifetime](<https://devfeed.tech/articles/extending-istio-self-signed-root-certificate-lifetime-48697.md>)

Original publisher: [Read original article](<https://istio.io/latest/blog/2019/root-transition/>)

Author: Oliver Liu

Published: 2019-06-07T00:00:00Z

Content type: tutorial

Language: en

Sources: [Istio Blog](<https://devfeed.tech/sources/istio-blog.md>)

Topics: [istio](<https://devfeed.tech/topics/istio.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [certificate](<https://devfeed.tech/tags/certificate.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [citadel](<https://devfeed.tech/tags/citadel.md>), [clusters](<https://devfeed.tech/tags/clusters.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [istio](<https://devfeed.tech/tags/istio.md>), [mesh](<https://devfeed.tech/tags/mesh.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [outage](<https://devfeed.tech/tags/outage.md>), [pki](<https://devfeed.tech/tags/pki.md>), [root](<https://devfeed.tech/tags/root.md>), [rotation](<https://devfeed.tech/tags/rotation.md>), [security](<https://devfeed.tech/tags/security.md>), [services](<https://devfeed.tech/tags/services.md>)

## AI overview

A guide to extending the lifetime of Istio self-signed root certificates and scheduling regular root transitions. It explains that the historical one-year lifetime can require annual rotation to prevent certificate expiration and potential cluster-wide outages.

## Source excerpt

Istio self-signed certificates have historically had a 1 year default lifetime. If you are using Istio self-signed certificates, you need to schedule regular root transitions before they expire. An expiration of a root certificate may lead to an unexpected cluster-wide outage. The issue affects new clusters created with versions up to 1.0.7 and 1.1.7. See Extending Self-Signed Certificate Lifetime for information on how to gauge the age of your certificates and how to perform rotation. We strongly recommend you rotate root keys and root certificates annually as a security best practice. We will send out instructions for root key/cert rotation soon.