How to update tls-san in /etc/rancher/rke2/config.yaml

[gauravkarki]

Is there anyway we can update the --tls-san in /etc/rancher/rke2/config.yaml after the completing the rke2 setup
From

tls-san:
   - host1.example.com

To

tls-san:
   - lb.example.com

[Martin-Weiss]

Not sure if that is supported but some time in the past I just added a tls-san and restarted rke2-server on all masters and it was working to get the additional san added..

[gauravkarki]

Thank you Martin for the information. I added them on all the master node. Is there a way to confirm if the new SAN is added to the cert?

[Martin-Weiss]

Yes - i.e. via openssl on the API:

echo|openssl s_client -connect host1.example.com:6443|openssl x509 -noout -text
echo|openssl s_client -connect lb.example.com:6443|openssl x509 -noout -text

or on the certificate file

openssl x509 -in /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt -noout -text

[gauravkarki]

Thank you very much Martin. It picked up the changes.