长时间未启动本地部署的rancher服务造成证书过期，rke2服务启动不起来。


问题表现

sudo systemctl status rke2-service.service

查看服务状态出，下面的异常提示

rke2-server.service - Rancher Kubernetes Engine v2 (server)
     Loaded: loaded (/usr/local/lib/systemd/system/rke2-server.service; enabled; vendor preset: enabled)
     Active: activating (start) since Sun 2026-08-09 20:13:58 CST; 3min 37s ago
       Docs: https://github.com/rancher/rke2#readme
    Process: 2219 ExecStartPre=/bin/sh -xc ! /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service (code=exited, status=0/SUCCESS)
    Process: 2233 ExecStartPre=/sbin/modprobe br_netfilter (code=exited, status=0/SUCCESS)
    Process: 2234 ExecStartPre=/sbin/modprobe overlay (code=exited, status=0/SUCCESS)
   Main PID: 2235 (rke2)
      Tasks: 15
     Memory: 46.8M
     CGroup: /system.slice/rke2-server.service
             └─2235 /usr/local/bin/rke2 server

Aug 09 20:17:28 rancher-service rke2[2235]: time="2026-08-09T20:17:28+08:00" level=info msg="Failed to test data store connection: context deadline exceeded"
Aug 09 20:17:29 rancher-service rke2[2235]: time="2026-08-09T20:17:29+08:00" level=error msg="CA cert validation failed: Get \"https://127.0.0.1:9345/cacerts\": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-0>
Aug 09 20:17:31 rancher-service rke2[2235]: time="2026-08-09T20:17:31+08:00" level=error msg="CA cert validation failed: Get \"https://127.0.0.1:9345/cacerts\": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-0>
Aug 09 20:17:33 rancher-service rke2[2235]: {"level":"warn","ts":"2026-08-09T20:17:33.144+0800","logger":"etcd-client","caller":"v3@v3.5.4-k3s1/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"etcd-endpoints://0xc000497340/127.0.0.1:2379","at>
Aug 09 20:17:33 rancher-service rke2[2235]: {"level":"info","ts":"2026-08-09T20:17:33.144+0800","logger":"etcd-client","caller":"v3@v3.5.4-k3s1/client.go:210","msg":"Auto sync endpoints failed.","error":"context deadline exceeded"}
Aug 09 20:17:33 rancher-service rke2[2235]: time="2026-08-09T20:17:33+08:00" level=info msg="Waiting for API server to become available"
Aug 09 20:17:33 rancher-service rke2[2235]: time="2026-08-09T20:17:33+08:00" level=info msg="Waiting for etcd server to become available"
Aug 09 20:17:33 rancher-service rke2[2235]: time="2026-08-09T20:17:33+08:00" level=error msg="CA cert validation failed: Get \"https://127.0.0.1:9345/cacerts\": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-0>

主要提示还是RKE2 在尝试通过 HTTPS 访问本地 9345 端口获取 CA 证书时，TLS 握手失败。失败的原因是 x509 证书验证不通过，提示证书“已过期或尚未生效”。

问题解决步骤

1、停止rke2服务

sudo systemctl stop rke2-server

2、执行手动证书更换命令

使用 RKE2 的内置命令强制轮换所有证书。如果你的环境变量未配置，建议使用绝对路径执行：

sudo /var/lib/rancher/rke2/bin/rke2 certificate rotate

(注：如果你的 RKE2 数据目录不在默认位置，可以加上 --data-dir /你的自定义目录 参数)

如果已经配置环境变量可以直接使用

sudo rke2 certificate rotate

成功后会打印下面的日志

INFO[0000] Server detected, rotating server certificates 
INFO[0000] Rotating certificates for admin service      
INFO[0000] Rotating certificates for etcd service       
INFO[0000] Rotating certificates for api-server service 
INFO[0000] Rotating certificates for controller-manager service 
INFO[0000] Rotating certificates for cloud-controller service 
INFO[0000] Rotating certificates for scheduler service  
INFO[0000] Rotating certificates for rke2-server service 
INFO[0000] Rotating dynamic listener certificate        
INFO[0000] Rotating certificates for rke2-controller service 
INFO[0000] Rotating certificates for auth-proxy service 
INFO[0000] Rotating certificates for kubelet service    
INFO[0000] Rotating certificates for kube-proxy service 
INFO[0000] Successfully backed up certificates for all services to path /var/lib/rancher/rke2/server/tls-1786278464, please restart rke2 server or agent to rotate certificates

3、重启RKE2 服务

sudo systemctl start rke2-server

4、验证服务与证书状态

sudo systemctl status rke2-server

如果服务正常运行，可以通过以下命令确认新证书的到期时间：

sudo /var/lib/rancher/rke2/bin/rke2 certificate check --output table

如果RKE2 版本比较旧，不支持 rke2 certificate check 这个命令（该命令是在较新的版本中才引入的）。

可以在终端中执行一下的命令

for cert in /var/lib/rancher/rke2/server/tls/*.crt; do
  echo "=== $(basename $cert) ==="
  openssl x509 -in "$cert" -noout -enddate 2>/dev/null
done

Linux 系统自带的 openssl 命令来查看证书的到期时间，它会遍历 RKE2 的证书目录并列出所有证书的到期时间