docker swarm ca

DescriptionDisplay and rotate the root CA
Usagedocker swarm ca [OPTIONS]

Swarm This command works with the Swarm orchestrator.


View or rotate the current swarm CA certificate.


This is a cluster management command, and must be executed on a swarm manager node. To learn about managers and workers, refer to the Swarm mode section in the documentation.


--ca-certPath to the PEM-formatted root CA certificate to use for the new cluster
--ca-keyPath to the PEM-formatted root CA key to use for the new cluster
--cert-expiry2160h0m0sValidity period for node certificates (ns|us|ms|s|m|h)
-d, --detachExit immediately instead of waiting for the root rotation to converge
--external-caSpecifications of one or more certificate signing endpoints
-q, --quietSuppress progress output
--rotateRotate the swarm CA - if no certificate or key are provided, new ones will be generated


Run the docker swarm ca command without any options to view the current root CA certificate in PEM format.

$ docker swarm ca


Pass the --rotate flag (and optionally a --ca-cert, along with a --ca-key or --external-ca parameter flag), in order to rotate the current swarm root CA.

$ docker swarm ca --rotate
desired root digest: sha256:05da740cf2577a25224c53019e2cce99bcc5ba09664ad6bb2a9425d9ebd1b53e
  rotated TLS certificates:  [=========================>                         ] 1/2 nodes
  rotated CA certificates:   [>                                                  ] 0/2 nodes

Once the rotation os finished (all the progress bars have completed) the now-current CA certificate will be printed:

$ docker swarm ca --rotate
desired root digest: sha256:05da740cf2577a25224c53019e2cce99bcc5ba09664ad6bb2a9425d9ebd1b53e
  rotated TLS certificates:  [==================================================>] 2/2 nodes
  rotated CA certificates:   [==================================================>] 2/2 nodes

Root CA rotation (--rotate)


Mirantis Kubernetes Engine (MKE), formerly known as Docker UCP, provides an external certificate manager service for the swarm. If you run swarm on MKE, you shouldn't rotate the CA certificates manually. Instead, contact Mirantis support if you need to rotate a certificate.

Root CA Rotation is recommended if one or more of the swarm managers have been compromised, so that those managers can no longer connect to or be trusted by any other node in the cluster.

Alternately, root CA rotation can be used to give control of the swarm CA to an external CA, or to take control back from an external CA.

The --rotate flag does not require any parameters to do a rotation, but you can optionally specify a certificate and key, or a certificate and external CA URL, and those will be used instead of an automatically-generated certificate/key pair.

Because the root CA key should be kept secret, if provided it will not be visible when viewing swarm any information via the CLI or API.

The root CA rotation will not be completed until all registered nodes have rotated their TLS certificates. If the rotation is not completing within a reasonable amount of time, try running docker node ls --format '{{.ID}} {{.Hostname}} {{.Status}} {{.TLSStatus}}' to see if any nodes are down or otherwise unable to rotate TLS certificates.

Run root CA rotation in detached mode (--detach)

Initiate the root CA rotation, but do not wait for the completion of or display the progress of the rotation.