diff --git a/pkg/runtime/init.go b/pkg/runtime/init.go
index 3359aaa68f5..ce99a957451 100644
--- a/pkg/runtime/init.go
+++ b/pkg/runtime/init.go
@@ -73,6 +73,10 @@ func (k *KubeadmRuntime) GenerateCert() error {
 	return k.sendNewCertAndKey([]string{k.getMaster0IPAndPort()})
 }
 
+func (k *KubeadmRuntime) SendNewCertAndKeyToMasters() error {
+	return k.sendNewCertAndKey(k.getMasterIPAndPortList())
+}
+
 func (k *KubeadmRuntime) CreateKubeConfig() error {
 	logger.Info("start to create kubeconfig...")
 	hostName, err := k.execHostname(k.getMaster0IPAndPort())
diff --git a/pkg/runtime/update_cert.go b/pkg/runtime/update_cert.go
index 7881e49de6b..dd6721492a0 100644
--- a/pkg/runtime/update_cert.go
+++ b/pkg/runtime/update_cert.go
@@ -130,7 +130,7 @@ func (k *KubeadmRuntime) UpdateCertByInit() error {
 func (k *KubeadmRuntime) initCert() error {
 	pipeline := []func() error{
 		k.GenerateCert,
-		k.syncCert,
+		k.SendNewCertAndKeyToMasters,
 	}
 	for _, f := range pipeline {
 		if err := f(); err != nil {
@@ -140,23 +140,6 @@ func (k *KubeadmRuntime) initCert() error {
 	return nil
 }
 
-func (k *KubeadmRuntime) syncCert() error {
-	for _, master := range k.getMasterIPAndPortList()[1:] {
-		logger.Debug("start to generate cert for master %s", master)
-		err := k.execCert(master)
-		if err != nil {
-			return fmt.Errorf("failed to create cert for master %s: %v", master, err)
-		}
-
-		err = k.copyMasterKubeConfig(master)
-		if err != nil {
-			return err
-		}
-		logger.Info("succeeded generate cert %s as master", master)
-	}
-	return nil
-}
-
 func (k *KubeadmRuntime) showKubeadmCert() error {
 	certCheck := "kubeadm certs check-expiration"
 	return k.sshCmdAsync(k.getMaster0IPAndPort(), fmt.Sprintf("%s%s", certCheck, vlogToStr(k.vlog)))