anchor.diff:  
   = Renewing CA certificates manually
   
  -Unless the `Kafka.spec.clusterCa.generateCertificateAuthority` and `Kafka.spec.clientsCa.generateCertificateAuthority` objects are set to `false`, the cluster and clients CA certificates will auto-renew at the start of their respective certificate renewal periods. 
  -You can manually renew one or both of these certificates before the certificate renewal period starts, if required for security reasons. 
  +Unless the `Kafka.spec.clusterCa.generateCertificateAuthority` and `Kafka.spec.clientsCa.generateCertificateAuthority` objects are set to `false`,
  +the cluster and clients CA certificates will auto-renew at the start of their respective certificate renewal periods.
  +
  +You can manually renew one or both of these certificates before the certificate renewal period starts, if required for security reasons.
   A renewed certificate uses the same private key as the old certificate.
   
   .Prerequisites
  
positive.code: ¦Annotate command
  
  ¦Cluster CA
  ¦_<cluster-name>_-cluster-ca-cert
  m¦kubectl annotate secret _<cluster-name>_-cluster-ca-cert strimzi.io/force-renew=true
  
  ¦Clients CA
  ¦_<cluster-name>_-clients-ca-cert
  m¦kubectl annotate secret _<cluster-name>_-clients-ca-cert strimzi.io/force-renew=true
  
  |===
  
  At the next reconciliation the Cluster Operator will generate a new CA certificate for the `Secret` that you annotated. 
  If maintenance time windows are configured, the Cluster Operator will generate the new CA certificate at the first reconciliation within the next maintenance time window.
  
  Client applications must reload the cluster and clients CA certificates that were renewed by the Cluster Operator.
  
  .Additional resources
  
  
negative.code: 
  .Procedure
  
  . Apply the `strimzi.io/force-renew` annotation to the `Secret` that contains the CA certificate that you want to renew.
  +
  .Annotation for Secret that forces renewal of certificates
  [cols="3*",options="header",stripes="none",separator=¦]
  |===
  
  