0

If I connect using SSL to a Google Cloud SQL 2nd gen MySQL server, the certificate is self-signed and it appears that the certificate only lasts 1 year. Before the year is up, I can refresh the certificate using gcloud sql instances reset-ssl-config [INSTANCE_NAME]. At this point a new certificate is generated and is immediately put into use at the MySQL server.

Unfortunately, this will result in downtime because I will have multiple different MySQL clients deployed whose --ssl-ca configuration would have to change as soon as the new server certificate is generated. Furthermore, the documentation indicates that all the client certificates are revoked too at the same time!

Is there any way to avoid client-side downtime on Google Cloud SQL MySQL when the server certificate is refreshed? For example, is it possible to generate the new server certificate without enabling it immediately, so that clients’ --ssl-ca can be updated, and then start using the new certificate once the clients are all ready?

For comparison, as described in a letter from the RDS team, Amazon RDS does not use self-signed certificates for the MySQL server. Instead, it uses a certificate (with a host name that validates with --ssl-verify-server-cert) and a certificate authority whose certificate lasts for 5 years. Before the CA certificate expires, Amazon publishes a certificate authority file that contains both the old CA certificates and the new CA certificates (since the mysql client’s --ssl-ca file can contain multiple trusted CAs certs). Once all clients trust the new CA cert and you are ready, you can swap the RDS MySQL server’s certificate from a cert signed by the old CA to a cert signed the new CA without any downtime.

0

The Cloud SQL service does not have a method for clients to upgrade the cert without downtime currently. I've taken the note and made a Feature Request to Google's Public Issue Tracker to implement the feature in Cloud SQL in the future.

There's no method to pre-fetch the CA data that would be used to update the cert so that the client could be prepared in advance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.