DOCKER(1) Docker User Manuals DOCKER(1)

# [NAME](#NAME)

docker-swarm-ca - Display and rotate the root CA

# [SYNOPSIS](#SYNOPSIS)

**docker swarm ca \[OPTIONS]**

# [DESCRIPTION](#DESCRIPTION)

Display and rotate the root CA

# [OPTIONS](#OPTIONS)

**--ca-cert**= Path to the PEM-formatted root CA certificate to use for the new cluster

**--ca-key**= Path to the PEM-formatted root CA key to use for the new cluster

**--cert-expiry**=2160h0m0s Validity period for node certificates (ns|us|ms|s|m|h)

**-d**, **--detach**\[=false] Exit immediately instead of waiting for the root rotation to converge

**--external-ca**= Specifications of one or more certificate signing endpoints

**-q**, **--quiet**\[=false] Suppress progress output

**--rotate**\[=false] Rotate the swarm CA - if no certificate or key are provided, new ones will be generated

# [SEE ALSO](#SEE_ALSO)

[**docker-swarm(1)**](/man/os/docker-cli/docker-swarm.1)

Sep 2026 Docker Community

---

Document: docker-swarm-ca(1) from docker-cli 29.8.1-r0 (Chainguard OS)
Source: https://github.com/docker/cli