managing-tls-certificates

Name: managing-tls-certificates
Availability: InStock
Author: CockroachDB

Manage TLS certificates for CockroachDB Cloud and self-hosted deployments.

3|3|Updated Mar 11, 2026

Search Tags:#cloud #mtls #tls #certificates #cockroachdb #certificate-rotation

Ready to run

npx skills add https://github.com/cockroachdb/claude-plugin --skill managing-tls-certificates

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: managing-tls-certificates
Source: https://github.com/cockroachdb/claude-plugin/tree/main/skills/security-and-governance/managing-tls-certificates
Command: npx skills add https://github.com/cockroachdb/claude-plugin --skill managing-tls-certificates

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

TLS certificate management for CockroachDB environments (Cloud and self-hosted), including CA configuration, client authentication setup, certificate rotation, and SSL/TLS troubleshooting.

Core Features & Use Cases

Manage Cloud TLS workflows: CA downloads, client CA uploads, and client certificate provisioning.
Self-hosted lifecycle: create and rotate CA, node, and client certificates with minimal downtime.
Troubleshooting and mTLS for CDC: diagnose TLS issues and configure mTLS for Kafka CDC pipelines.

Quick Start

Choose your deployment model (Cloud or self-hosted) and follow the TLS setup steps to download the CA certificate, configure client authentication, rotate certificates, and verify TLS connections.

Frequently Asked Questions about managing-tls-certificates

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I rotate TLS certificates for a CockroachDB cluster with minimal downtime?▼

You can rotate CockroachDB TLS certificates with minimal downtime by following the self-hosted lifecycle workflow to create and rotate CA, node, and client certificates without interrupting cluster operations.

How do I configure mTLS for CockroachDB CDC changefeeds to Kafka?▼

Configure mTLS for CockroachDB CDC changefeeds by applying the TLS setup steps to provision certificates and establish mutual TLS authentication for secure Kafka pipeline data streaming.

Why am I getting SSL/TLS errors when connecting to CockroachDB Cloud?▼

Resolve SSL/TLS errors in CockroachDB Cloud by verifying CA downloads and client certificate authentication, using the diagnostic workflows to troubleshoot and fix invalid or expired certificates.

Can I use the ccloud CLI to provision client certificates for CockroachDB Cloud?▼

Yes, you can use the ccloud CLI to manage Cloud TLS workflows, including downloading the CA certificate, uploading client CAs, and provisioning client certificates for authentication.

What's the best way to manage the CA lifecycle for self-hosted CockroachDB deployments?▼

Manage the self-hosted CockroachDB CA lifecycle by creating and rotating CA certificates using the cockroach cert command and OpenSSL, covering complete CA setup, node, and client certificate requirements.

Does this TLS certificate management process work for both CockroachDB Cloud and self-hosted deployments?▼

Yes, the TLS certificate management process applies to both CockroachDB Cloud and self-hosted deployments, covering CA downloads, client authentication, and certificate rotation across both environments.