En esta página, se describe cómo ver y luego implementar recomendaciones sobre la rotación de certificados
del servidor para instancias cuyos certificados de servidor están a punto de vencer en 30 días.
Si el certificado del servidor de una instancia está a punto de vencer en 30 días, los clientes
que usan este certificado no podrán conectarse de forma segura a la instancia, lo que los hace vulnerables a violaciones de la seguridad. Este recomendador se llama Certificado para rotar el servidor.
Todos los días, este recomendador
verifica las instancias en busca de certificados vencidos y proporciona estadísticas y recomendaciones para mejorar la seguridad de la instancia. Puedes ver estadísticas y recomendaciones detalladas sobre estas instancias desde la consola Google Cloud , gcloud CLI o la API de Recommender.
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=ROTATE_SERVER_CERT
Reemplaza lo siguiente:
PROJECT_ID: ID del proyecto
LOCATION: Es una región en la que se encuentran las instancias, como us-central1.
Visualiza las estadísticas y las recomendaciones detalladas
Para visualizar estadísticas y recomendaciones detalladas, sigue estos pasos:
Console
Después de enumerar las recomendaciones, haz clic en una.
Aparecerá el panel de recomendaciones, que contiene estadísticas y recomendaciones detalladas.
LOCATION: una región en la que se encuentran las instancias, como us-central1.
API
Llama al método insights.list de la siguiente manera:
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=SERVER_CERT_EXPIRING
Reemplaza lo siguiente:
PROJECT_ID: ID del proyecto
LOCATION: Es una región en la que se encuentran las instancias, como us-central1.
Aplica la recomendación
Console
Para implementar la recomendación, haz clic en Administrar certificados del servidor y rota los certificados del servidor
en tu instancia.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-09 (UTC)"],[],[],null,["# Improve instance security by rotating server certificates\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/recommender-rotate-cert \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/recommender-rotate-cert \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\nThis page describes how to view and implement recommendations about rotating server\ncertificates for instances whose server certificates are about to expire within 30 days.\nIf an instance's server certificate is about to expire within 30 days, then the clients\nusing this certificate won't be able securely connect to the instance, making them vulnerable to security breaches. This [recommender](/recommender/docs/overview) is called **Rotate server certificate**.\n\nEvery day, this recommender\nchecks instances for expiring certificates and provides insights and recommendations to improve your instance security. You can view insights and detailed recommendations about these instances by using the Google Cloud console,\n[gcloud CLI](/sdk/gcloud), or the [Recommender API](/recommender/docs/using-api).\n\nBefore you begin\n----------------\n\nEnsure that you [enable the Recommender API](/recommender/docs/enabling).\n\n### Required roles and permissions\n\nTo get the permissions to view and work with insights and recommendations,\nensure that you have the required [Identity and Access Management (IAM) roles](/sql/docs/sqlserver/project-access-control#roles).\n\nFor more information about IAM roles, see [IAM basic and predefined roles reference](/iam/docs/understanding-roles) and [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\nList the recommendations\n------------------------\n\nTo list the recommendations, follow these steps: \n\n### Console\n\nTo list recommendations about instance security, follow these steps:\n\n1. Go to the **Cloud SQL Instances** page.\n\n [Go to Cloud SQL Instances](https://console.cloud.google.com/sql/instances)\n2. View the **Issues** column in the instance table.\n\nAlternatively, follow these steps:\n\n1. Go to the **Recommendation Hub**.\n\n [Go to the Recommendation Hub](https://console.cloud.google.com/home/recommendations/)\n\n For more information, see [Exploring recommendations](/recommender/docs/recommendation-hub/identify-configuration-problems).\n2. In the **All recommendations** card, click **Security**.\n\n### gcloud\n\nRun the [`gcloud recommender recommendations list`](/sdk/gcloud/reference/recommender/recommendations/list) command as follows: \n\n```\ngcloud recommender recommendations list \\\n--project=PROJECT_ID \\\n--location=LOCATION \\\n--recommender=google.cloudsql.instance.SecurityRecommender \\\n--filter=recommenderSubtype=ROTATE_SERVER_CERT\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region where your instances are located, such as us-central1.\n\n### API\n\nCall the [`recommendations.list`](/recommender/docs/reference/rest/v1beta1/projects.locations.recommenders.recommendations/list) method as follows: \n\n```\nGET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=ROTATE_SERVER_CERT\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region where your instances are located, such as `us-central1`.\n\nView insights and detailed recommendations\n------------------------------------------\n\nTo view insights and detailed recommendations, follow these steps: \n\n### Console\n\nAfter listing the recommendations, click a recommendation.\nThe recommendation panel appears, which contains insights and detailed recommendations.\n\n### gcloud\n\nRun the [`gcloud recommender insights list`](/sdk/gcloud/reference/recommender/insights/list) command as follows: \n\n```\n\ngcloud recommender insights list \\\n--project=PROJECT_ID \\\n--location=LOCATION \\\n--insight-type=google.cloudsql.instance.SecurityInsight \\\n--filter=insightSubtype=SERVER_CERT_EXPIRING\n\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e : A region where your instances are located, such as `us-central1`.\n\n### API\n\nCall the [`insights.list`](/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes.insights/list) method as follows: \n\n```\n\nGET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=SERVER_CERT_EXPIRING\n\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region where your instances are located, such as `us-central1`.\n\nApply the recommendation\n------------------------\n\n### Console\n\nTo implement the recommendation, click **Manage server certificates** and [rotate server certificates](/sql/docs/sqlserver/manage-ssl-instance#rotate)\non your instance.\n\n### gcloud\n\nTo implement the recommendation, [rotate server certificates](/sql/docs/sqlserver/manage-ssl-instance#rotate)\non your instance.\n\n### API\n\nTo implement the recommendation, [rotate server certificates](/sql/docs/sqlserver/manage-ssl-instance#rotate)\non your instance.\n\nWhat's next\n-----------\n\n- [Rotate server certificates](/sql/docs/sqlserver/manage-ssl-instance#rotate)\n- [Google Cloud recommenders](/recommender/docs/recommenders)\n- [Blog: Maximize your Cloud ROI](https://cloud.google.com/blog/products/management-tools/active-assist-comes-to-google-cloud)"]]
