TL;DR: If oc login works but the web console throws "Authentication error", and your cluster is about 2 years old, the default ingress certificate has probably expired.

The symptom

The console login page showed a generic "Authentication error. There was an error logging you in." Meanwhile oc login with kubeadmin worked fine. Nothing had changed on the cluster for two years, which was the clue.

Why the API works and the console doesn't

oc login talks to the API and the OAuth server directly. The console does a full browser OAuth redirect, and the console pod itself has to call the oauth-openshift route over TLS to exchange the auth code. That route is served by the default ingress wildcard cert.

Diagnosis

oc get co authentication console ingress
oc logs -n openshift-console deploy/console --tail=100
oc get secret router-certs-default -n openshift-ingress -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -dates -subject

The authentication and console operators were Degraded with this message:

x509: certificate has expired or is not yet valid: current time 2026-10-19T08:04:50Z is after 2026-10-17T08:54:26Z

The console logs said the same thing: unable to verify auth code with issuer ... x509: certificate has expired. The wildcard cert and the router-ca that signed it were both issued by the ingress operator at install time with a 2-year lifetime. Both expired on the same second, and the operator never rotated them.

The cluster also raised an Insights alert, "Unable to login to the cluster when the certificate of default ingress controller is expired", but it fired about 90 minutes after expiry, so it was no help as a warning.

The fix

Delete the expired secrets so the ingress operator regenerates them. In my case, deleting router-certs-default alone wasn't enough because the CA had expired too, so I deleted both:

oc delete secret router-certs-default -n openshift-ingress
oc delete secret router-ca -n openshift-ingress-operator

Then nothing happened. The operator logs were full of secret openshift-ingress/router-certs-default does not exist and neither secret came back. Restarting the operator pod forced a fresh reconcile, and it recreated both within seconds:

oc delete pod -n openshift-ingress-operator -l name=ingress-operator
oc get secret router-ca -n openshift-ingress-operator
oc get secret router-certs-default -n openshift-ingress

Gotcha: don't restart the router pod while the secret is missing. The running pod is still serving from its mounted copy, and a restart without the secret would take down every *.apps route, including the console.

Once the new secrets exist, check what the router is actually serving, and roll it if it's still the old cert:

echo | openssl s_client -connect oauth-openshift.apps.<your-domain>:443 -servername oauth-openshift.apps.<your-domain> 2>/dev/null | openssl x509 -noout -dates -issuer
oc rollout restart deployment/router-default -n openshift-ingress
oc rollout status deployment/router-default -n openshift-ingress

If the authentication or console operators stay Degraded with "unknown authority" errors, bounce their pods so they reload the trust bundle:

oc delete pod -n openshift-authentication --all
oc delete pod -n openshift-console --all

Because the CA was regenerated, anything that pinned the old router CA needs the new one:

oc get configmap default-ingress-cert -n openshift-config-managed -o jsonpath='{.data.ca-bundle\.crt}' > router-ca.crt

Don't let it happen again

The regenerated cert has the same 2-year lifetime, so you're on the clock again. Options:

1. A calendar reminder.
2. The proper fix: a custom default ingress cert from your own CA (cert-manager works well) set via spec.defaultCertificate on the default IngressController, with auto-renewal.

A cron job on your jumpbox that alerts when the cert is close to expiry:

echo | openssl s_client -connect oauth-openshift.apps.<your-domain>:443 -servername oauth-openshift.apps.<your-domain> 2>/dev/null | openssl x509 -noout -checkend $((60*86400)) || echo "Ingress cert expires within 60 days"

If you run a homelab or long-lived demo cluster that was installed around the same time, go check your cert dates now.