This page describes how to manage your client and server CA certificates.
Manage client certificates
Use the following procedures to manage client certificates in Cloud SQL.
Retrieve a client certificate
You can retrieve the public key portion of a client certificate. You cannot
retrieve the private key, however. If you have lost your private key, you must
create a new certificate.
Console
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
In Manage client certificates , click a certificate name.
The SSL Client Certificate page
opens and shows the client certificate (client-cert.pem
) with
a link to download the certificate.
gcloud
Retrieve the client certificate public key with the
ssl client-certs describe
command:
gcloud sql ssl client-certs describe CERT_NAME \
--instance=INSTANCE_NAME \
--format="value(cert)" > client-cert.pem
REST v1
List the certificates on the instance to get the fingerprint of the
certificate you want to retrieve:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#sslCertsList",
"items": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint "
"instance": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint ",
"createTime": "2020-02-13T00:10:20.595Z",
"expirationTime": "2030-02-10T00:11:20.595Z"
}
]
}
Record the sha1Fingerprint
field for the certificate you want
to retrieve. Don't include the quotation marks.
Retrieve the certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
sha1FingerPrint : The cert's sha1FingerPrint
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint "
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint " | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint "
"instance": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint ",
"createTime": "2020-02-13T00:10:20.595Z",
"expirationTime": "2030-02-10T00:11:20.595Z"
}
Copy all of the certificate data contained by the quotation marks
to a file, for example client-cert.pem
. Don't copy the
quotation marks themselves.
REST v1beta4
List the certificates on the instance to get the fingerprint of the
certificate you want to retrieve:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#sslCertsList",
"items": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint "
"instance": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint ",
"createTime": "2020-02-13T00:10:20.595Z",
"expirationTime": "2030-02-10T00:11:20.595Z"
}
]
}
Record the sha1Fingerprint
field for the certificate you want
to retrieve. Don't include the quotation marks.
Retrieve the certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
sha1FingerPrint : The cert's sha1FingerPrint
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint "
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint " | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint "
"instance": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint ",
"createTime": "2020-02-13T00:10:20.595Z",
"expirationTime": "2030-02-10T00:11:20.595Z"
}
Copy all of the certificate data contained by the quotation marks
to a file, for example client-cert.pem
. Don't copy the
quotation marks themselves.
Delete a client certificate
When you delete a client certificate, the database server is updated and doesn't need to be restarted.
Console
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
In Manage client certificates , find the certificate you want to
delete and click .
In the Delete client certificate pane, click Ok .
gcloud
Delete the client certificate using the
ssl client-certs delete command:
gcloud sql ssl client-certs delete CERT_NAME \
--instance=INSTANCE_NAME
REST v1
List the certificates on the instance to get the fingerprint of the
certificate you want to delete:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#sslCertsList",
"items": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint "
"instance": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint ",
"createTime": "2020-02-13T00:10:20.595Z",
"expirationTime": "2030-02-10T00:11:20.595Z"
}
]
}
Record the sha1Fingerprint
field for the certificate you want
to delete. Don't include the quotation marks.
Delete the certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
sha1FingerPrint : The cert's sha1FingerPrint
HTTP method and URL:
DELETE https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X DELETE \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint "
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method DELETE ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint " | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
REST v1beta4
List the certificates on the instance to get the fingerprint of the
certificate you want to delete:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#sslCertsList",
"items": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint "
"instance": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint ",
"createTime": "2020-02-13T00:10:20.595Z",
"expirationTime": "2030-02-10T00:11:20.595Z"
}
]
}
Record the sha1Fingerprint
field for the certificate you want
to delete. Don't include the quotation marks.
Delete the certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
sha1FingerPrint : The cert's sha1FingerPrint
HTTP method and URL:
DELETE https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X DELETE \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint "
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method DELETE ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /sslCerts/sha1FingerPrint " | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
Manage server CA certificates
Rotate server CA certificates
If you've received a notice about your certificates expiring, or you have
initiated a rotation, then you must take the following steps to complete the
rotation:
Download the new server CA certificate information.
Update your clients to use the new server CA certificate information.
Complete the rotation, which moves the active certificate into
the "previous" slot and updates the newly added certificate to be the
active certificate.
After rotating the SSL certificate, your App Engine and
Cloud SQL Auth Proxy connections will automatically receive a new certificate
when they connect.
Console
Download the new server CA certificate information:
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
Click to expand Manage certificates .
Select Rotate CA certificate .
If there are no eligible certificates, then the
rotate option is unavailable.
Click Download Certificates .
The server CA certificate information, encoded as a PEM file, is downloaded
to your local environment:
Update all of your PostgreSQL clients to use the new information by
copying the downloaded file to your client host machines, replacing the
existing server-ca.pem
file.
After you have updated your clients, complete the rotation:
Return to the Security tab.
Click to expand Manage certificates .
Select Rotate CA certificate .
Confirm that your clients are connecting properly.
If any clients are not connecting using the newly rotated certificate,
then you can select Rollback CA certificate to
rollback to the previous configuration.
gcloud
Create a server CA certificate:
gcloud beta sql ssl server-ca-certs create \
--instance=INSTANCE
Download the certificate information to a local PEM file:
gcloud beta sql ssl server-ca-certs list \
--format="value(cert)" \
--instance=INSTANCE_NAME > \
FILE_PATH /FILE_NAME .pem
Update all of your clients to use the new information by
copying the downloaded file to your client host machines, replacing the
existing server-ca.pem files.
After you have updated your clients, complete the rotation:
gcloud beta sql ssl server-ca-certs rotate \
--instance=INSTANCE_NAME
Confirm that your clients are connecting properly.
If any clients are not connecting using the newly rotated certificate,
then you can rollback to the previous configuration.
REST v1
Download your server CA certificates:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /listServerCas
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /listServerCas"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /listServerCas" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"certs": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2020-02-10T17:18:54.935Z",
"expirationTime": "2030-02-07T17:19:54.935Z"
},
{
"kind": "sql#sslCert",
certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2019-11-14T22:43:56.458Z",
"expirationTime": "2029-11-11T22:44:56.458Z"
}
],
"activeVersion": "active-version ",
"kind": "sql#instancesListServerCas"
}
Complete the rotation:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d "" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
REST v1beta4
Download your server CA certificates:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /listServerCas
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /listServerCas"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /listServerCas" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"certs": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2020-02-10T17:18:54.935Z",
"expirationTime": "2030-02-07T17:19:54.935Z"
},
{
"kind": "sql#sslCert",
certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2019-11-14T22:43:56.458Z",
"expirationTime": "2029-11-11T22:44:56.458Z"
}
],
"activeVersion": "active-version ",
"kind": "sql#instancesListServerCas"
}
Complete the rotation:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d "" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
Roll back a certificate rotation operation
After you complete a certificate rotation, your clients must all use the
new certificate to connect to your Cloud SQL instance. If the clients
aren't updated properly to use the new certificate information, then they can't
connect using SSL/TLS to your instance. If this happens, then you can
roll back to the previous certificate configuration.
A rollback operation moves the active certificate into the "upcoming"
slot (replacing any "upcoming" certificate). The "previous"
certificate becomes the active certificate, returning your
certificate configuration to the state it was in before you completed
the rotation.
Note: Certificate rollback is available only until the old certificate expires.
To roll back to the previous certificate configuration:
Console
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
Click to expand Manage certificates .
Select Rollback CA certificate . If there are no eligible certificates,
then the rollback option is unavailable. Otherwise, the rollback
action completes after a few seconds.
gcloud
gcloud beta sql ssl server-ca-certs rollback \
--instance=INSTANCE_NAME
REST v1
Download your server CA certificates:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /listServerCas
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /listServerCas"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /listServerCas" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"certs": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2020-02-10T17:18:54.935Z",
"expirationTime": "2030-02-07T17:19:54.935Z"
},
{
"kind": "sql#sslCert",
certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2019-11-14T22:43:56.458Z",
"expirationTime": "2029-11-11T22:44:56.458Z"
}
],
"activeVersion": "active-version ",
"kind": "sql#instancesListServerCas"
}
Copy the sha1Fingerprint
field for the version you want to roll back to.
Look for the version with a createTime value immediately earlier
than the version with the sha1Fingerprint value shown as
activeVersion
.
Roll back the rotation:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa
Request JSON body:
{
"rotateServerCaContext": {"nextVersion": "sha1Fingerprint "}
}
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Save the request body in a file named request.json
,
and execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa"
PowerShell (Windows)
Save the request body in a file named request.json
,
and execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -ContentType: "application/json; charset=utf-8" ` -InFile request.json ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
REST v1beta4
Download your server CA certificates:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /listServerCas
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /listServerCas"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /listServerCas" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"certs": [
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2020-02-10T17:18:54.935Z",
"expirationTime": "2030-02-07T17:19:54.935Z"
},
{
"kind": "sql#sslCert",
certSerialNumber": "cert-serial-number ",
"cert": "cert-value ",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2019-11-14T22:43:56.458Z",
"expirationTime": "2029-11-11T22:44:56.458Z"
}
],
"activeVersion": "active-version ",
"kind": "sql#instancesListServerCas"
}
Copy the sha1Fingerprint
field for the version you want to roll back to.
Look for the version with a createTime value immediately earlier
than the version with the sha1Fingerprint value shown as
activeVersion
.
Roll back the rotation:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa
Request JSON body:
{
"rotateServerCaContext": {"nextVersion": "sha1Fingerprint "}
}
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Save the request body in a file named request.json
,
and execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa"
PowerShell (Windows)
Save the request body in a file named request.json
,
and execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -ContentType: "application/json; charset=utf-8" ` -InFile request.json ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
Initiate a rotation
You don't need to wait for the email from Cloud SQL to start a rotation.
You can start one at any time. When you start a rotation, a new certificate
is created and placed into the "upcoming" slot. If a certificate is already present
in the "upcoming" slot at the time of your request, then that certificate is deleted.
There can be only one upcoming certificate.
To initiate a rotation:
Console
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
Click Create new CA certificate .
Click to expand Manage certificates .
Select Rotate CA certificate .
If there are no eligible certificates,
then the rotate option is unavailable.
Complete the rotation as described in
Rotate server CA certificates .
gcloud
Initiate the rotation:
gcloud beta sql ssl server-ca-certs create \
--instance=INSTANCE_NAME
Complete the rotation as described in
Rotate server CA certificates .
REST v1
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d "" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id /rotateServerCa" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
Complete the rotation as described in
Rotate server CA certificates .
REST v1beta4
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d "" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /rotateServerCa" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
Complete the rotation as described in
Rotate server CA certificates .
Get information about a server CA certificate
You can get information about your server CA certificate, such as when it expires
or what level of encryption it provides.
Console
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
In Manage server CA certificates , you can see the expiration date
of your server CA certificate in the table.
To see the certificate type, use the
gcloud beta sql ssl server-ca-certs list --instance=INSTANCE_NAME
command.
gcloud
gcloud beta sql ssl server-ca-certs list \
--instance=INSTANCE_NAME
REST v1
When you describe your instance, you can see details about the server CA
certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ?fields=serverCaCert
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ?fields=serverCaCert"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/v1/projects/project-id /instances/instance-id ?fields=serverCaCert" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"serverCaCert":
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value -",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2020-02-10T17:18:54.935Z",
"expirationTime": "2030-02-07T17:19:54.935Z"
}
}
REST v1beta4
When you describe your instance, you can see details about the server
CA certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ?fields=serverCaCert
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ?fields=serverCaCert"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method GET ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ?fields=serverCaCert" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"serverCaCert":
{
"kind": "sql#sslCert",
"certSerialNumber": "cert-serial-number ",
"cert": "cert-value -",
"commonName": "ca-server-name ",
"sha1Fingerprint": "sha1Fingerprint ",
"instance": "instance-id ",
"createTime": "2020-02-10T17:18:54.935Z",
"expirationTime": "2030-02-07T17:19:54.935Z"
}
}
Reset the SSL/TLS configuration
You can completely reset your SSL/TLS configuration.
Caution: Performing this action removes the ability to connect to your instance
using SSL/TLS until you create new client certificates to replace any
that were previously in use.
Console
In the Google Cloud console, go to the Cloud SQL Instances page.
Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Go to the Reset SSL configuration section.
Click Reset SSL Configuration .
REST v1beta4
Refresh the certificate:
Before using any of the request data,
make the following replacements:
project-id : The project ID
instance-id : The instance ID
HTTP method and URL:
POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /resetSslConfig
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note:
The following command assumes that you have logged in to
the gcloud
CLI with your user account by running
gcloud init
or
gcloud auth login
, or by using Cloud Shell ,
which automatically logs you into the gcloud
CLI
.
You can check the currently active account by running
gcloud auth list
.
Execute the following command:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d "" \ "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /resetSslConfig"
PowerShell (Windows)
Execute the following command:
$cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id /resetSslConfig" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{
"kind": "sql#operation",
"targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /instances/instance-id ",
"status": "PENDING",
"user": "user@example.com",
"insertTime": "2020-01-20T21:30:35.667Z",
"operationType": "UPDATE",
"name": "operation-id ",
"targetId": "instance-id ",
"selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id /operations/operation-id ",
"targetProject": "project-id "
}
Create new client certificates .
What's next