If I connect using SSL to a Google Cloud SQL 2nd gen MySQL server, the certificate is self-signed and it appears that the certificate only lasts 1 year. Before the year is up, I can refresh the certificate using gcloud sql instances reset-ssl-config [INSTANCE_NAME]. At this point a new certificate is generated and is immediately put into use at the MySQL server.
Unfortunately, this will result in downtime because I will have multiple different MySQL clients deployed whose --ssl-ca configuration would have to change as soon as the new server certificate is generated. Furthermore, the documentation indicates that all the client certificates are revoked too at the same time!
Is there any way to avoid client-side downtime on Google Cloud SQL MySQL when the server certificate is refreshed? For example, is it possible to generate the new server certificate without enabling it immediately, so that clients’ --ssl-ca can be updated, and then start using the new certificate once the clients are all ready?
For comparison, as described in a letter from the RDS team, Amazon RDS does not use self-signed certificates for the MySQL server. Instead, it uses a certificate (with a host name that validates with --ssl-verify-server-cert) and a certificate authority whose certificate lasts for 5 years. Before the CA certificate expires, Amazon publishes a certificate authority file that contains both the old CA certificates and the new CA certificates (since the mysql client’s --ssl-ca file can contain multiple trusted CAs certs). Once all clients trust the new CA cert and you are ready, you can swap the RDS MySQL server’s certificate from a cert signed by the old CA to a cert signed the new CA without any downtime.
google-cloud-platform
