Recently we’ve started facing issue with outbound calls for some pods when trying to connect with services within same cluster. Can see following logs in proxy [9515905.481616s] WARN ThreadId(01) outbound:proxy{addr=10.247.15.20:4191}:forward{addr=10.247.15.20:4191}: linkerd_reconnect: Failed to …

Hey @Shubham — yes, restarting pods is indeed how to force a reissue. I’m more curious about the identity issuer rotation – how was that done? Did the control plane get restarted afterward?

Hi @Flynn , thanks for reply. We use auto cert rotation via cert manager. That shouldn’t require control plane pods restart unless it’s trust anchor. During issue we restarted the control plane in sequence identity-issuer >> destination/proxy. Otherwise it was throwing poststarthook error in linker…

Hi @Flynn , We faced another instance of this same problem in another cluster this time there was no recent cert renewal for any controller pods. [706995.441763s] ERROR ThreadId(02) identity:identity{server.addr=linkerd-identity-headless.linkerd.svc.cluster.local:8080}: linkerd_proxy_identity_clien…

I’ve learned something that might be relevant here: if you rotate the identity issuer certificate but the trust bundle hasn’t been updated first, you can end up in a state where the identity controller hangs on to the old issuer, which can be tricky to detect. I wonder if this is what’s happening to…

linkerd-Identity-Issuer not refreshing certificates as expected

Linkerd General Discussion

Flynn November 20, 2025, 4:17pm 5

Hmmm. How long are your certificates valid? How often does cert-manager rotate them?

(A short lag between rotating the identity issuer and seeing new workload certs is normal. Many days is not normal.)

Topic		Replies	Views
ERROR: failed to verify issuer credentials for 'identity.linkerd.cluster.local' with trust anchors: x509: certificate has expired or is not yet valid Linkerd General Discussion certificates	4	2119	January 22, 2024
Trouble with trusted anchors. I don't know where to look Linkerd General Discussion certificates	3	78	July 14, 2025
Linkerd check --proxy Linkerd General Discussion certificates	3	71	December 31, 2024
[Cert-Manager] Webhook Certificates renewal Failure Linkerd General Discussion certificates	4	1702	August 16, 2023
Cert is not issued by the trust anchor error after a couple days Linkerd General Discussion proxy , certificates	1	250	November 25, 2024

linkerd-Identity-Issuer not refreshing certificates as expected

Related topics