skills.rest
cockroachdb
cockroachdbOFFICIAL
Explore all skills by this author →
WebsiteGitHub

managing-certificates-and-encryption

Manage TLS certificates and CMEK keys across deployment tiers.

3|3|Updated Mar 11, 2026
Search Tags:#security#encryption#tls#rotation#certificates#key-management#cmek
One-click install
npx skills add https://github.com/cockroachdb/claude-plugin --skill managing-certificates-and-encryption
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: managing-certificates-and-encryption
Source: https://github.com/cockroachdb/claude-plugin/tree/main/skills/operations-and-lifecycle/managing-certificates-and-encryption
Command: npx skills add https://github.com/cockroachdb/claude-plugin --skill managing-certificates-and-encryption

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Managing TLS certificates and CMEK across multi-tier deployments is complex and error-prone, risking outages and data exposure if not properly coordinated.

Core Features & Use Cases

  • Certificate lifecycle management for self-hosted and cloud deployments, including expiry monitoring and rotation.
  • CMEK management across Advanced/BYOC, including cloud KMS integration and policy auditing.
  • Guidance for Standard/Basic deployments with fully managed TLS and encryption, plus safety and rollback procedures.
  • Safety-focused procedures and references to rotate certificates with minimal downtime and risk.

Quick Start

Identify your deployment tier and I will outline a secure rotation and CMEK plan.

Frequently Asked Questions about managing-certificates-and-encryption

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I rotate TLS certificates with minimal downtime in a self-hosted cluster?▼

Rotate TLS certificates with minimal downtime using the combined CA rotation approach, which enforces tier-specific safety guidance and rollback procedures to prevent outages during the certificate lifecycle.

What is CMEK and how does it work across cloud deployment tiers?▼

CMEK, or Customer-Managed Encryption Keys, works across Advanced and BYOC deployment tiers by integrating with cloud KMS providers to ensure trusted data protection and enable policy auditing for your encryption keys.

Does this approach support fully managed TLS and encryption for Standard deployments?▼

Yes, Standard and Basic deployments support fully managed TLS and encryption, providing built-in safety and rollback procedures without requiring manual certificate lifecycle management or custom key configuration.

How do I monitor TLS certificate expiry across multiple deployment tiers?▼

Monitor TLS certificate expiry across deployment tiers by applying tier-specific requirements, which coordinate expiry tracking and rotation schedules to ensure continuous encrypted communications and prevent unexpected failures.

What are the limitations of managing CMEK operations in BYOC environments?▼

CMEK operations in BYOC environments require careful policy auditing and cloud KMS integration, with limitations mitigated through enforced safety procedures that guide key rotation and prevent data exposure risks.

Related Skills

Explore More Software Engineering Skills→
cockroachdbcockroachdb
3

enabling-cmek-encryption

Enable CMEK encryption on CockroachDB Cloud clusters with AWS KMS, GCP Cloud KMS, or Azure Key Vault.

Official
Advanced
TeoSlayerTeoSlayer
7

pilot-keychain

Exchange credentials securely between Pilot Protocol agents with automatic expiry and end-to-end encryption.

Community
Advanced
cropsggcropsgg
15

canary

Automate post-deploy canary health checks and rollback on threshold breaches.

Community
Advanced
masermediagroup-stackmasermediagroup-stack
1

implementing-tls

Configure and validate TLS and mutual TLS for service traffic.

Community
Advanced