Manage SSL/TLS certificates

MySQL | PostgreSQL | SQL Server

This page describes how to manage your client and server certificate authority (CA) certificates.

Manage client certificates

Use the following procedures to manage client certificates in Cloud SQL.

Retrieve a client certificate

You can retrieve the public key portion of a client certificate. You cannot retrieve the private key, however. If you have lost your private key, you must create a new certificate.

Console

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
In Manage client certificates, click a certificate name.
The SSL Client Certificate page opens and shows the client certificate (client-cert.pem) with a link to download the certificate.

gcloud

Retrieve the client certificate public key with the ssl client-certs describe command:

gcloud sql ssl client-certs describe CERT_NAME \
--instance=INSTANCE_NAME \
--format="value(cert)" > client-cert.pem

REST v1

List the certificates on the instance to get the fingerprint of the certificate you want to retrieve:

Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
```
GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts
```
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts"
```
PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts" | Select-Object -Expand Content
```
You should receive a JSON response similar to the following:
Response
```
{
  "kind": "sql#sslCertsList",
  "items": [
    {
      "kind": "sql#sslCert",
      "certSerialNumber": "cert-serial-number",
      "cert": "cert-value",
      "commonName": "ca-server-name",
      "sha1Fingerprint": "sha1Fingerprint"
      "instance": "instance-id",
      "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint",
      "createTime": "2020-02-13T00:10:20.595Z",
      "expirationTime": "2030-02-10T00:11:20.595Z"
    }
  ]
}
```
Record the sha1Fingerprint field for the certificate you want to retrieve. Don't include the quotation marks.

Retrieve the certificate:

Before using any of the request data, make the following replacements:

project-id: The project ID
instance-id: The instance ID
sha1FingerPrint: The cert's sha1FingerPrint

HTTP method and URL:

GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#sslCert",
  "certSerialNumber": "cert-serial-number",
  "cert": "cert-value",
  "commonName": "ca-server-name",
  "sha1Fingerprint": "sha1Fingerprint"
  "instance": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint",
  "createTime": "2020-02-13T00:10:20.595Z",
  "expirationTime": "2030-02-10T00:11:20.595Z"
}

Copy all of the certificate data contained by the quotation marks to a file, for example client-cert.pem. Don't copy the quotation marks themselves.

REST v1beta4

List the certificates on the instance to get the fingerprint of the certificate you want to retrieve:

Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
```
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts
```
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts"
```
PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts" | Select-Object -Expand Content
```
You should receive a JSON response similar to the following:
Response
```
{
  "kind": "sql#sslCertsList",
  "items": [
    {
      "kind": "sql#sslCert",
      "certSerialNumber": "cert-serial-number",
      "cert": "cert-value",
      "commonName": "ca-server-name",
      "sha1Fingerprint": "sha1Fingerprint"
      "instance": "instance-id",
      "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint",
      "createTime": "2020-02-13T00:10:20.595Z",
      "expirationTime": "2030-02-10T00:11:20.595Z"
    }
  ]
}
```
Record the sha1Fingerprint field for the certificate you want to retrieve. Don't include the quotation marks.

Retrieve the certificate:

Before using any of the request data, make the following replacements:

project-id: The project ID
instance-id: The instance ID
sha1FingerPrint: The cert's sha1FingerPrint

HTTP method and URL:

GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#sslCert",
  "certSerialNumber": "cert-serial-number",
  "cert": "cert-value",
  "commonName": "ca-server-name",
  "sha1Fingerprint": "sha1Fingerprint"
  "instance": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint",
  "createTime": "2020-02-13T00:10:20.595Z",
  "expirationTime": "2030-02-10T00:11:20.595Z"
}

Copy all of the certificate data contained by the quotation marks to a file, for example client-cert.pem. Don't copy the quotation marks themselves.

Delete a client certificate

When you delete a client certificate, the database server is updated and doesn't need to be restarted.

Console

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
In Manage client certificates, find the certificate you want to delete and click .
In the Delete client certificate pane, click Ok.

gcloud

Delete the client certificate using the ssl client-certs delete command:

gcloud sql ssl client-certs delete CERT_NAME \
--instance=INSTANCE_NAME

REST v1

List the certificates on the instance to get the fingerprint of the certificate you want to delete:

Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
```
GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts
```
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts"
```
PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts" | Select-Object -Expand Content
```
You should receive a JSON response similar to the following:
Response
```
{
  "kind": "sql#sslCertsList",
  "items": [
    {
      "kind": "sql#sslCert",
      "certSerialNumber": "cert-serial-number",
      "cert": "cert-value",
      "commonName": "ca-server-name",
      "sha1Fingerprint": "sha1Fingerprint"
      "instance": "instance-id",
      "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint",
      "createTime": "2020-02-13T00:10:20.595Z",
      "expirationTime": "2030-02-10T00:11:20.595Z"
    }
  ]
}
```
Record the sha1Fingerprint field for the certificate you want to delete. Don't include the quotation marks.

Delete the certificate:

Before using any of the request data, make the following replacements:

project-id: The project ID
instance-id: The instance ID
sha1FingerPrint: The cert's sha1FingerPrint

HTTP method and URL:

DELETE https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X DELETE \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method DELETE `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-20T21:30:35.667Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

REST v1beta4

List the certificates on the instance to get the fingerprint of the certificate you want to delete:

Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
```
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts
```
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts"
```
PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Execute the following command:
```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts" | Select-Object -Expand Content
```
You should receive a JSON response similar to the following:
Response
```
{
  "kind": "sql#sslCertsList",
  "items": [
    {
      "kind": "sql#sslCert",
      "certSerialNumber": "cert-serial-number",
      "cert": "cert-value",
      "commonName": "ca-server-name",
      "sha1Fingerprint": "sha1Fingerprint"
      "instance": "instance-id",
      "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint",
      "createTime": "2020-02-13T00:10:20.595Z",
      "expirationTime": "2030-02-10T00:11:20.595Z"
    }
  ]
}
```
Record the sha1Fingerprint field for the certificate you want to delete. Don't include the quotation marks.

Delete the certificate:

Before using any of the request data, make the following replacements:

project-id: The project ID
instance-id: The instance ID
sha1FingerPrint: The cert's sha1FingerPrint

HTTP method and URL:

DELETE https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X DELETE \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method DELETE `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/sslCerts/sha1FingerPrint" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-20T21:30:35.667Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Manage server CA certificates (per-instance CA)

This section describes how to manage server CA certificates that are created internally by Cloud SQL. This is the default server CA mode in Cloud SQL. In this certificate authority hierarchy, Cloud SQL creates a server CA for each instance.

Rotate server CA certificates

If you've received a notice about your certificates expiring, or you want to initiate a rotation, then take the following steps to complete the rotation. Before you start the rotation, you must have a new server CA on the instance. If a new server CA has already been created, then you can skip the first step in the following procedure.

Create a new server CA.
Download the new server CA certificate information.
Update your clients to use the new server CA certificate information.
Complete the rotation, which moves the active certificate into the "previous" slot and updates the newly added certificate to be the active certificate.

Console

Download the new server CA certificate, encoded as a PEM file, to your local environment:

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Select Connections from the SQL navigation menu.
Select the Security tab.
Click to expand Manage certificates.
Select Rotate CA certificate.
If there are no eligible certificates, then the rotate option is unavailable. You must create a new server CA certificate.
Click Download Certificates.

Update all of your MySQL clients to use the new information by copying the downloaded file to your client host machines, replacing the existing server-ca.pem file.

After you have updated your clients, complete the rotation:

Return to the Security tab.
Click to expand Manage certificates.
Select Rotate CA certificate.
Confirm that your clients are connecting properly.

If any clients are not connecting using the newly rotated certificate, then you can select Rollback CA certificate to rollback to the previous configuration.

gcloud

Create a server CA certificate:

gcloud sql ssl server-ca-certs create \
--instance=INSTANCE

Download the certificate information to a local PEM file:

gcloud sql ssl server-ca-certs list \
--format="value(cert)" \
--instance=INSTANCE_NAME > \
FILE_PATH/FILE_NAME.pem

Update all of your clients to use the new information by copying the downloaded file to your client host machines, replacing the existing server-ca.pem files.

After you have updated your clients, complete the rotation:

gcloud sql ssl server-ca-certs rotate \
--instance=INSTANCE_NAME

Confirm that your clients are connecting properly.

If any clients are not connecting using the newly rotated certificate, then you can rollback to the previous configuration.

REST v1

Download your server CA certificates:

Before using any of the request data, make the following replacements:

project-id: The project ID
instance-id: The instance ID

HTTP method and URL:

GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/listServerCas

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/listServerCas"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/listServerCas" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "certs": [
    {
      "kind": "sql#sslCert",
      "certSerialNumber": "cert-serial-number",
      "cert": "cert-value",
      "commonName": "ca-server-name",
      "sha1Fingerprint": "sha1Fingerprint",
      "instance": "instance-id",
      "createTime": "2020-02-10T17:18:54.935Z",
      "expirationTime": "2030-02-07T17:19:54.935Z"
    },
    {
      "kind": "sql#sslCert",
       certSerialNumber": "cert-serial-number",
      "cert": "cert-value",
      "commonName": "ca-server-name",
      "sha1Fingerprint": "sha1Fingerprint",
      "instance": "instance-id",
      "createTime": "2019-11-14T22:43:56.458Z",
      "expirationTime": "2029-11-11T22:44:56.458Z"
    }
  ],
  "activeVersion": "active-version",
  "kind": "sql#instancesListServerCas"
}

Complete the rotation:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
```
POST https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/rotateServerCa
```
To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running

Manage SSL/TLS certificates Stay organized with collections Save and categorize content based on your preferences.

Manage client certificates

Retrieve a client certificate

Console

gcloud

REST v1

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

REST v1beta4

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

Delete a client certificate

Console

gcloud

REST v1

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

REST v1beta4

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

Manage server CA certificates (per-instance CA)

Rotate server CA certificates

Console

gcloud

REST v1

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

Manage SSL/TLS certificates