// Arrange: stub renew() to return a mocked CredentialsInternal
        when(renewable.renew()).thenReturn(returned);

        // Act: invoke renew()
        CredentialsInternal result = renewable.renew();

        // Assert: verify interaction and returned value
        verify(renewable, times(1)).renew();
        assertSame(returned, result, "renew() should return the stubbed value");

    }

    @Test
    @DisplayName("Should renew credentials when they are renewable and renew() returns new credentials")
    void testRenewCredentials_RenewableAndRenewed() {
        // Set up the wrapper with renewable credentials
        wrapper = new CIFSContextCredentialWrapper(mockDelegate, mockRenewableCredentials);
        when(mockRenewableCredentials.renew()).thenReturn(mockRenewedCredentialsInternal);

 *
 * @author mbechler
 */
public interface SmbRenewableCredentials extends CredentialsInternal {

    /**
     * Renew the credentials
     *
     * @return the renewed credentials
     */
    CredentialsInternal renew();

            this.cachedSubject = null;
            return null;
        }
    }

    /**
     * {@inheritDoc}
     *
     * @see jcifs.smb.SmbRenewableCredentials#renew()
     */
    @Override
    public CredentialsInternal renew() {
        log.debug("Renewing credentials");
        this.cachedSubject = null;
        getSubject();
        return this;
    }

    /**
     * {@inheritDoc}

     *
     * @param creds the credentials to use
     * @return a child context using using the given credentials
     */
    CIFSContext withCredentials(Credentials creds);

    /**
     * Attempt to renew credentials after authentication failure
     *
     * @param locationHint URL or location hint for credential renewal
     * @param error the error that triggered renewal
     * @return whether new credentials are obtained

        // Then
        assertEquals(newContext, context);
        verify(mockContext).withCredentials(creds);
    }

    @Test
    @DisplayName("Should renew credentials")
    void testRenewCredentials() {
        // Given
        String hint = "hint";
        Throwable error = new Exception();
        when(mockContext.renewCredentials(hint, error)).thenReturn(true);

        }
    }

    @Test
    @DisplayName("renew: invokes getSubject and returns self")
    void testRenewInvokesGetSubjectAndReturnsSelf() {
        JAASAuthenticator auth = spy(new JAASAuthenticator());
        // Avoid real JAAS by stubbing getSubject
        doReturn(new Subject()).when(auth).getSubject();

        // Act
        CredentialsInternal result = auth.renew();

        // Assert interaction and return value

<img src="/img/deployment/https/https.drawio.svg">

The **TLS certificates** are **associated with a domain name**, not with an IP address.

So, to renew the certificates, the renewal program needs to **prove** to the authority (Let's Encrypt) that it indeed **"owns" and controls that domain**.

                }
            } else {
                if (!this.ctx.renewCredentials(loc.getURL().toString(), sae)) {
                    throw sae;
                }
                log.debug("Trying to renew credentials after auth error");
                try (SmbSessionInternal s = trans.getSmbSession(this.ctx, treesess.getTargetHost(), treesess.getTargetDomain())

on a node host or move it to a safe location. `kubadm certs renew` will renew the certificate in `super-admin.conf` to one year if the file exists; if it does not exist a "MISSING" note will be printed. `kubeadm upgrade apply` for this release will migrate this particular node to the two file setup. Subsequent kubeadm releases will continue to optionally renew the certificate in `super-admin.conf` if the file exists on disk and if renew on upgrade is not disabled. `kubeadm join --control-plane` will...