Merge pull request #107525 from zr-msft/zr-aks-update-cert-details

PRMerger9 · web-flow · commit 6c1d7039fbe4 · 2020-03-12T14:17:15.000-07:00
[AKS] add details for certificate expiration
diff --git a/articles/aks/certificate-rotation.md b/articles/aks/certificate-rotation.md
@@ -32,7 +32,7 @@ AKS generates and uses the following certificates, Certificate Authorities, and
 * The `kubectl` client has a certificate for communicating with the AKS cluster.
 
 > [!NOTE]
-> AKS clusters created prior to March 2019 have certificates that expire after two years. Any cluster created after March 2019 or any cluster that has its certificates rotated have certificates that expire after 30 years. To verify when your cluster was created, use `kubectl get nodes` to see the *Age* of your node pools.
+> AKS clusters created prior to March 2019 have certificates that expire after two years. Any cluster created after March 2019 or any cluster that has its certificates rotated have Cluster CA certificates that expire after 30 years. All other certificates expire after two years. To verify when your cluster was created, use `kubectl get nodes` to see the *Age* of your node pools.
 > 
 > Additionally, you can check the expiration date of your cluster's certificate. For example, the following command displays the certificate details for the *myAKSCluster* cluster.
 > ```console

Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ AKS generates and uses the following certificates, Certificate Authorities, and`
`32`	`32`	* The `kubectl` client has a certificate for communicating with the AKS cluster.
`33`	`33`
`34`	`34`	`> [!NOTE]`
`35`		-> AKS clusters created prior to March 2019 have certificates that expire after two years. Any cluster created after March 2019 or any cluster that has its certificates rotated have certificates that expire after 30 years. To verify when your cluster was created, use `kubectl get nodes` to see the Age of your node pools.
	`35`	+> AKS clusters created prior to March 2019 have certificates that expire after two years. Any cluster created after March 2019 or any cluster that has its certificates rotated have Cluster CA certificates that expire after 30 years. All other certificates expire after two years. To verify when your cluster was created, use `kubectl get nodes` to see the Age of your node pools.
`36`	`36`	`>`
`37`	`37`	`> Additionally, you can check the expiration date of your cluster's certificate. For example, the following command displays the certificate details for the myAKSCluster cluster.`
`38`	`38`	> ```console