I did check all of the certs referenced in /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml and also all of the certs passed as arguments to kube-apiserver and none are expired.