diff --git a/cluster/clustercfg/ca.py b/cluster/clustercfg/ca.py
index 9ed2053..0107080 100644
--- a/cluster/clustercfg/ca.py
+++ b/cluster/clustercfg/ca.py
@@ -1,4 +1,5 @@
 # encoding: utf-8
+from datetime import datetime, timezone
 import json
 import logging
 import os
@@ -171,6 +172,35 @@
 
         return key, csr
 
+    def gen_csr(self, key, hosts, o=_std_subj['O'], ou=_std_subj['OU']):
+        """
+        Generate a CSR while already having a private key - for renewals, etc.
+
+        TODO(q3k): this shouldn't be a CA method, but a cert method.
+        """
+        cfg = {
+            "CN": hosts[0],
+            "hosts": hosts,
+            "key": {
+                "algo": "rsa",
+                "size": 4096,
+            },
+            "names": [
+                {
+                    "C": _std_subj["C"],
+                    "ST": _std_subj["ST"],
+                    "L": _std_subj["L"],
+                    "O": o,
+                    "OU": ou,
+                },
+            ],
+        }
+        cfg.update(_ca_config)
+        logger.info("{}: Generating CSR for {}".format(self, hosts))
+        out = self._cfssl_call(['gencsr', '-key', key, '-'], obj=cfg)
+
+        return out['csr']
+
     def sign(self, csr, save=None, profile='client-server'):
         logging.info("{}: Signing CSR".format(self))
         ca = self._cert
@@ -246,12 +276,30 @@
         with open(self.cert_path) as f:
             return f.read()
 
+    @property
+    def cert_expires_soon(self):
+        if not self.cert_exists:
+            return False
+
+        out = self.ca._cfssl_call(['certinfo', '-cert', self.cert_path], stdin="")
+        not_after = datetime.strptime(out['not_after'], '%Y-%m-%dT%H:%M:%SZ').replace(tzinfo=timezone.utc)
+        until = not_after - datetime.now(timezone.utc)
+        if until.days < 30:
+            return True
+        return False
+
     def ensure(self):
-        if self.key_exists and self.cert_exists:
+        if self.key_exists and self.cert_exists and not self.cert_expires_soon:
             return
 
-        logger.info("{}: Generating...".format(self))
-        key, csr = self.ca.gen_key(self.hosts, o=self.o, ou=self.ou, save=self.key)
+        key = None
+        if not self.key_exists:
+            logger.info("{}: Generating key...".format(self))
+            key, csr = self.ca.gen_key(self.hosts, o=self.o, ou=self.ou, save=self.key)
+        else:
+            logger.info("{}: Renewing certificate...".format(self))
+            # Use already existing key
+            csr = self.ca.gen_csr(self.key_path, self.hosts, o=self.o, ou=self.ou)
         self.ca.sign(csr, save=self.cert, profile=self.profile)
 
     def upload(self, c, remote_cert, remote_key, concat_ca=False):
diff --git a/cluster/clustercfg/clustercfg.py b/cluster/clustercfg/clustercfg.py
index eb9f52d..c3e7bd6 100644
--- a/cluster/clustercfg/clustercfg.py
+++ b/cluster/clustercfg/clustercfg.py
@@ -175,7 +175,7 @@
         ca_kube = ca.CA(ss, certs_root, 'kube', 'kubernetes main CA')
 
         # Make prodvider intermediate CA.
-        ca_kube.make_cert('ca-kube-prodvider', o='Warsaw Hackerspace', ou='kubernetes prodvider intermediate', hosts=['kubernetes prodvider intermediate CA'], profile='intermediate')
+        ca_kube.make_cert('ca-kube-prodvider', o='Warsaw Hackerspace', ou='kubernetes prodvider intermediate', hosts=['kubernetes prodvider intermediate CA'], profile='intermediate').ensure()
 
         # Make kubelet certificate (per node).
         ca_kube.make_cert('kube-kubelet-'+fqdn, o='system:nodes', ou='Kubelet', hosts=['system:node:'+fqdn, fqdn])