Managing TLS Certificates

Manages TLS certificates for CockroachDB clusters, covering CA certificate downloads, client certificate authentication setup, certificate rotation, and troubleshooting common SSL/TLS connection errors. Addresses both CockroachDB Cloud (always-on TLS) and self-hosted certificate lifecycle management.

When to Use This Skill

• Troubleshooting SSL/TLS connection errors from application clients (DBeaver, TypeORM, psql, Go, Python, Java)
• Setting up client certificate authentication on CockroachDB Cloud
• Uploading a custom Client CA to a Cloud cluster
• Rotating or renewing certificates (Cloud or self-hosted)
• Configuring mTLS for CDC changefeeds to Kafka
• Downloading or locating the CA certificate for a Cloud cluster

Prerequisites

CockroachDB Cloud:

• ccloud CLI authenticated (ccloud auth login)
• Cloud Console access for CA certificate download
• Cluster Admin role for client CA configuration