etcd peer cert issue after cert renewal

[sudheshpn]

HI all,
I have a multimaster node with 3 etcd pod running on each of the node. My cluster cert got expired due to which i had to use kubeadm alpha certs renew all to renew all the Cluster certs.
Even though the certs are renewed the ETCD pod are not coming up due to below error. Looks like the peer cert which is used by each of the etcd pod to communicate is having some issue. i tried to print the peer.crt but i am unable to find any issue.I even tried using kubeadm alpha certs renew etcd-peer but no luck

etcd_pnmomv0314.log
etcd_pnmomv0315.log

health check for peer 2c2a564436018bd9 could not connect: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "etcd-ca")

2023-06-21 11:10:58.162142 I | embed: rejected connection from "10.218.30.182:11550" (error "remote error: tls: bad certificate", ServerName "")

[jmhbnz]

Hey @sudheshpn - It looks like you are using etcd v3.4.3. This is a four year old release and countless bugs and security issues have been addressed since then. My suggestion would be to update to the latest etcd 3.4 or ideally 3.5 release as soon as possible.

In relation to the certificate issue you might want to refer to #15949 which sounded similar, however as mentioned above my first suggestion would be to upgrade.