[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-managing-certificates-and-encryption":3,"mdc-y1oc6y-key":39,"related-repo-cockroachdb-managing-certificates-and-encryption":1745,"related-org-cockroachdb-managing-certificates-and-encryption":1841},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"managing-certificates-and-encryption","manage TLS certificates and encryption keys","Manages TLS certificate and encryption key lifecycle across all tiers. Self-Hosted covers certificate expiry monitoring, node\u002FCA\u002Fclient cert rotation, and Kubernetes cert management. Advanced\u002FBYOC covers managed TLS (no action) and CMEK (Customer-Managed Encryption Key) rotation in your KMS. Standard and Basic have fully managed TLS and encryption with no customer action. CMEK is only available on Advanced. Use when monitoring cert health, performing rotation, managing CMEK, or responding to key compromise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Cryptography","cryptography",{"name":20,"slug":21,"type":15},"Database","database",{"name":23,"slug":24,"type":15},"Kubernetes","kubernetes",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:57:13.556511",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-operations-and-lifecycle\u002Fmanaging-certificates-and-encryption","---\nname: managing-certificates-and-encryption\ndescription: Manages TLS certificate and encryption key lifecycle across all tiers. Self-Hosted covers certificate expiry monitoring, node\u002FCA\u002Fclient cert rotation, and Kubernetes cert management. Advanced\u002FBYOC covers managed TLS (no action) and CMEK (Customer-Managed Encryption Key) rotation in your KMS. Standard and Basic have fully managed TLS and encryption with no customer action. CMEK is only available on Advanced. Use when monitoring cert health, performing rotation, managing CMEK, or responding to key compromise.\ncompatibility: Self-Hosted requires SQL admin access and filesystem access for cert rotation. Advanced\u002FBYOC requires Cloud Console for CMEK management. Standard and Basic certificates and encryption are fully managed.\nmetadata:\n  author: cockroachdb\n  version: \"2.0\"\n---\n\n# Managing Certificates and Encryption\n\nManages TLS certificate and encryption key lifecycle across all deployment tiers. Before providing procedures, this skill gathers context to determine whether the operator manages certificates directly (Self-Hosted), manages CMEK encryption keys (Advanced\u002FBYOC), or has fully managed encryption (Standard\u002FBasic).\n\n## When to Use This Skill\n\n- Monitoring certificate expiration (Self-Hosted)\n- Performing scheduled certificate rotation (Self-Hosted)\n- Managing CMEK encryption keys (Advanced\u002FBYOC)\n- Responding to key compromise (Self-Hosted, CMEK)\n- Auditing encryption posture for compliance (all tiers)\n- Adding DNS names or IPs to node certificates (Self-Hosted)\n\n**For daily health checks:** Use [reviewing-cluster-health](..\u002Freviewing-cluster-health\u002FSKILL.md).\n\n---\n\n## Step 1: Gather Context\n\n### Required Context\n\n| Question | Options | Why It Matters |\n|----------|---------|----------------|\n| **Deployment tier?** | Self-Hosted, Advanced, BYOC, Standard, Basic | Determines encryption management responsibility |\n| **Reason?** | Routine monitoring, Scheduled rotation, Key compromise, Compliance audit, Add SAN entries | Determines urgency and procedure |\n\n### Additional Context (by tier)\n\n**If Self-Hosted:**\n\n| Question | Options | Why It Matters |\n|----------|---------|----------------|\n| **Certificate type?** | CA, Node, Client, UI | Different rotation procedures per type |\n| **Deployment platform?** | Bare metal\u002FVMs, Kubernetes (Operator\u002FHelm\u002Fmanual) | Changes rotation tooling |\n| **Certificate tooling?** | cockroach cert, openssl, HashiCorp Vault, cert-manager | Determines generation commands |\n| **Is the CA being rotated?** | Yes, No | CA rotation requires combined CA approach |\n\n**If Advanced or BYOC:**\n\n| Question | Options | Why It Matters |\n|----------|---------|----------------|\n| **Is this about CMEK?** | Yes, No | CMEK is the customer's encryption responsibility; TLS is managed by CRL |\n| **Cloud provider?** | AWS, GCP, Azure | Determines KMS service and CLI commands |\n| **CMEK currently enabled?** | Yes, No | CMEK must be enabled at cluster creation |\n\n**If Standard or Basic:** No context needed — TLS and encryption are fully managed. CMEK is not available on these tiers.\n\n### Context-Driven Routing\n\n| Tier + Scenario | Go To |\n|-----------------|-------|\n| Self-Hosted | [Self-Hosted Certificate Management](#self-hosted-certificate-management) |\n| Advanced\u002FBYOC + CMEK | [CMEK Key Management](#cmek-key-management) |\n| Advanced\u002FBYOC + TLS question | [Cloud TLS (Managed)](#cloud-tls-managed) |\n| Standard | [Fully Managed Encryption](#fully-managed-encryption) |\n| Basic | [Fully Managed Encryption](#fully-managed-encryption) |\n\n---\n\n## Self-Hosted Certificate Management\n\n**Applies when:** Tier = Self-Hosted\n\n### Monitor Certificate Expiry\n\nNo production-safe SQL view exposes certificate expiration. Use one of:\n\n```bash\n# Inspect certs locally on each node\ncockroach cert list --certs-dir=\u003Ccerts-dir>\n\n# Or read a specific cert file\nopenssl x509 -in \u003Ccerts-dir>\u002Fnode.crt -noout -enddate\n\n# Or scrape the per-node Prometheus endpoint (UNIX seconds for ca, node, client_ca, ui_ca)\ncurl -ks https:\u002F\u002F\u003Cnode>:8080\u002F_status\u002Fvars | grep '^security_certificate_expiration_'\n```\n\nAlert thresholds: CA \u003C 1 year = plan rotation. Node \u003C 90 days = schedule rotation. Node \u003C 30 days = rotate immediately.\n\n### Rotate Node Certificates (Same CA)\n\n```bash\ncockroach cert create-node \u003Chostname> \u003Cip> \u003Clb-hostname> \u003Clb-ip> localhost 127.0.0.1 \\\n  --certs-dir=\u003Ccerts-dir> --ca-key=\u003Cca-key-path> --overwrite\n```\n\nDeploy to node, set `chmod 0600` on key file. CockroachDB auto-detects new certs — no restart required.\n\nSee [rotation-procedures reference](references\u002Frotation-procedures.md) for detailed steps and verification.\n\n### Rotate CA Certificate\n\nCA rotation requires a combined certificate (new + old) for seamless trust transition:\n\n1. Generate new CA key and certificate\n2. Create combined CA file: `cat new-ca.crt old-ca.crt > ca.crt`\n3. Deploy combined CA to all nodes\n4. Re-issue node and client certificates signed by the new CA\n5. After all entities use new-CA-signed certs, remove old CA from combined file\n\nSee [rotation-procedures reference](references\u002Frotation-procedures.md) for the full CA rotation procedure.\n\n### Kubernetes Certificate Management\n\n- **CockroachDB Operator:** Self-signer rotates automatically. Configure via `tls.certs.selfSigner.rotateCerts`.\n- **cert-manager:** Auto-renews. Pods may need restart to pick up new certs.\n\nSee [kubernetes-certs reference](references\u002Fkubernetes-certs.md) for detailed Kubernetes procedures.\n\n---\n\n## CMEK Key Management\n\n**Applies when:** Tier = Advanced or BYOC, CMEK enabled\n\n### What Is CMEK\n\nCustomer-Managed Encryption Keys wrap CockroachDB's data-at-rest encryption with a key stored in your cloud provider's KMS. CockroachDB Cloud never has access to the CMEK itself.\n\nCMEK requires an Advanced cluster with advanced security features enabled at cluster creation. It cannot be enabled retroactively. **CMEK is not available on Standard or Basic.**\n\n### Check CMEK Status\n\n```bash\ncurl -s -H \"Authorization: Bearer $COCKROACH_API_KEY\" \\\n  \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fcmek\" | jq '.'\n```\n\nOr: Cloud Console → Cluster → Security → Encryption.\n\n### Rotate CMEK Key\n\nRotate the key in your cloud provider's KMS. CockroachDB Cloud automatically uses the new key version. No cluster downtime.\n\nSee [cmek-procedures reference](references\u002Fcmek-procedures.md) for provider-specific KMS rotation commands (AWS KMS, GCP Cloud KMS, Azure Key Vault) and IAM audit procedures.\n\n### Emergency: Revoke CMEK Key\n\nRevoking the CMEK key makes cluster data **permanently inaccessible** unless the key is restored within your KMS provider's grace period.\n\n**Only use as an emergency kill switch.** This may be irreversible.\n\n---\n\n## Cloud TLS (Managed)\n\n**Applies when:** Tier = Advanced or BYOC, question is about TLS (not CMEK)\n\nTLS certificates are fully managed by Cockroach Labs on Advanced and BYOC:\n- Provisioning, rotation, and renewal are automatic\n- No customer action needed\n- Certificate health is monitored by CRL\n\n**Client certificates:** You manage your own client-side certificates for application connections. These are standard PostgreSQL client certificates.\n\n---\n\n## Fully Managed Encryption\n\n**Applies when:** Tier = Standard or Basic\n\nTLS certificates and data-at-rest encryption are fully managed by Cockroach Labs.\n- No certificate visibility or rotation responsibility\n- Encryption in transit is always enabled\n- Encryption at rest is always enabled\n- CMEK is not available on these tiers\n\n**If CMEK is required:** Upgrade to Advanced.\n\n---\n\n## Safety Considerations\n\n**Read-only monitoring queries are safe on all tiers.**\n\n**Self-Hosted certificate operations:**\n- Always backup existing certificates before rotation\n- Use combined CA approach — never abruptly replace the CA\n- Verify SAN entries include ALL hostnames, IPs, and load balancer addresses\n- CA key must be stored separately from node certificates\n- File permissions: key files must be mode 0600, owned by cockroach process user\n\n**CMEK operations (Advanced\u002FBYOC):**\n- CMEK key revocation renders data permanently inaccessible\n- Verify IAM permissions before and after KMS key rotation\n- Test CMEK rotation in a staging cluster first\n\nSee [safety-guide reference](references\u002Fsafety-guide.md) for detailed risk matrix.\n\n## Troubleshooting\n\n| Issue | Tier | Fix |\n|-------|------|-----|\n| Cert metric NULL | SH | Verify cluster is in secure mode |\n| New cert not detected | SH | Check file permissions (0600, correct owner) |\n| \"unknown authority\" error | SH | Deploy combined CA (new + old) |\n| Connection failures after rotation | SH | Check SAN entries cover all hostnames\u002FIPs |\n| CMEK access denied | ADV\u002FBYOC | Verify KMS key policy and IAM permissions |\n| Cannot enable CMEK | ADV\u002FBYOC | CMEK must be enabled at cluster creation |\n\n## References\n\n**Skill references:**\n- [Certificate rotation procedures](references\u002Frotation-procedures.md)\n- [Kubernetes certificate management](references\u002Fkubernetes-certs.md)\n- [CMEK procedures by cloud provider](references\u002Fcmek-procedures.md)\n- [Safety guide](references\u002Fsafety-guide.md)\n\n**Related skills:**\n- [reviewing-cluster-health](..\u002Freviewing-cluster-health\u002FSKILL.md)\n- [managing-cluster-settings](..\u002Fmanaging-cluster-settings\u002FSKILL.md)\n\n**Official CockroachDB Documentation:**\n- [Rotate Security Certificates](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frotate-certificates)\n- [cockroach cert](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcockroach-cert)\n- [TLS and PKI Reference](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Ftransport-layer-security)\n- [Manage CMEK](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fmanaging-cmek)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Self-Hosted requires SQL admin access and filesystem access for cert rotation. Advanced\u002FBYOC requires Cloud Console for CMEK management. Standard and Basic certificates and encryption are fully managed.",{"author":8,"version":43},"2.0",{"type":45,"children":46},"root",[47,55,61,68,103,123,127,133,140,215,221,229,337,345,430,440,446,551,554,559,569,575,580,802,807,813,963,976,989,995,1000,1035,1045,1051,1081,1093,1096,1101,1110,1116,1121,1131,1137,1223,1228,1234,1239,1251,1257,1269,1279,1282,1287,1296,1301,1319,1329,1332,1337,1346,1351,1374,1384,1387,1393,1401,1409,1437,1445,1463,1475,1481,1611,1617,1625,1660,1668,1687,1695,1739],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Managing Certificates and Encryption",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Manages TLS certificate and encryption key lifecycle across all deployment tiers. Before providing procedures, this skill gathers context to determine whether the operator manages certificates directly (Self-Hosted), manages CMEK encryption keys (Advanced\u002FBYOC), or has fully managed encryption (Standard\u002FBasic).",{"type":48,"tag":62,"props":63,"children":65},"h2",{"id":64},"when-to-use-this-skill",[66],{"type":53,"value":67},"When to Use This Skill",{"type":48,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88,93,98],{"type":48,"tag":73,"props":74,"children":75},"li",{},[76],{"type":53,"value":77},"Monitoring certificate expiration (Self-Hosted)",{"type":48,"tag":73,"props":79,"children":80},{},[81],{"type":53,"value":82},"Performing scheduled certificate rotation (Self-Hosted)",{"type":48,"tag":73,"props":84,"children":85},{},[86],{"type":53,"value":87},"Managing CMEK encryption keys (Advanced\u002FBYOC)",{"type":48,"tag":73,"props":89,"children":90},{},[91],{"type":53,"value":92},"Responding to key compromise (Self-Hosted, CMEK)",{"type":48,"tag":73,"props":94,"children":95},{},[96],{"type":53,"value":97},"Auditing encryption posture for compliance (all tiers)",{"type":48,"tag":73,"props":99,"children":100},{},[101],{"type":53,"value":102},"Adding DNS names or IPs to node certificates (Self-Hosted)",{"type":48,"tag":56,"props":104,"children":105},{},[106,112,114,121],{"type":48,"tag":107,"props":108,"children":109},"strong",{},[110],{"type":53,"value":111},"For daily health checks:",{"type":53,"value":113}," Use ",{"type":48,"tag":115,"props":116,"children":118},"a",{"href":117},"..\u002Freviewing-cluster-health\u002FSKILL.md",[119],{"type":53,"value":120},"reviewing-cluster-health",{"type":53,"value":122},".",{"type":48,"tag":124,"props":125,"children":126},"hr",{},[],{"type":48,"tag":62,"props":128,"children":130},{"id":129},"step-1-gather-context",[131],{"type":53,"value":132},"Step 1: Gather Context",{"type":48,"tag":134,"props":135,"children":137},"h3",{"id":136},"required-context",[138],{"type":53,"value":139},"Required Context",{"type":48,"tag":141,"props":142,"children":143},"table",{},[144,168],{"type":48,"tag":145,"props":146,"children":147},"thead",{},[148],{"type":48,"tag":149,"props":150,"children":151},"tr",{},[152,158,163],{"type":48,"tag":153,"props":154,"children":155},"th",{},[156],{"type":53,"value":157},"Question",{"type":48,"tag":153,"props":159,"children":160},{},[161],{"type":53,"value":162},"Options",{"type":48,"tag":153,"props":164,"children":165},{},[166],{"type":53,"value":167},"Why It Matters",{"type":48,"tag":169,"props":170,"children":171},"tbody",{},[172,194],{"type":48,"tag":149,"props":173,"children":174},{},[175,184,189],{"type":48,"tag":176,"props":177,"children":178},"td",{},[179],{"type":48,"tag":107,"props":180,"children":181},{},[182],{"type":53,"value":183},"Deployment tier?",{"type":48,"tag":176,"props":185,"children":186},{},[187],{"type":53,"value":188},"Self-Hosted, Advanced, BYOC, Standard, Basic",{"type":48,"tag":176,"props":190,"children":191},{},[192],{"type":53,"value":193},"Determines encryption management responsibility",{"type":48,"tag":149,"props":195,"children":196},{},[197,205,210],{"type":48,"tag":176,"props":198,"children":199},{},[200],{"type":48,"tag":107,"props":201,"children":202},{},[203],{"type":53,"value":204},"Reason?",{"type":48,"tag":176,"props":206,"children":207},{},[208],{"type":53,"value":209},"Routine monitoring, Scheduled rotation, Key compromise, Compliance audit, Add SAN entries",{"type":48,"tag":176,"props":211,"children":212},{},[213],{"type":53,"value":214},"Determines urgency and procedure",{"type":48,"tag":134,"props":216,"children":218},{"id":217},"additional-context-by-tier",[219],{"type":53,"value":220},"Additional Context (by tier)",{"type":48,"tag":56,"props":222,"children":223},{},[224],{"type":48,"tag":107,"props":225,"children":226},{},[227],{"type":53,"value":228},"If Self-Hosted:",{"type":48,"tag":141,"props":230,"children":231},{},[232,250],{"type":48,"tag":145,"props":233,"children":234},{},[235],{"type":48,"tag":149,"props":236,"children":237},{},[238,242,246],{"type":48,"tag":153,"props":239,"children":240},{},[241],{"type":53,"value":157},{"type":48,"tag":153,"props":243,"children":244},{},[245],{"type":53,"value":162},{"type":48,"tag":153,"props":247,"children":248},{},[249],{"type":53,"value":167},{"type":48,"tag":169,"props":251,"children":252},{},[253,274,295,316],{"type":48,"tag":149,"props":254,"children":255},{},[256,264,269],{"type":48,"tag":176,"props":257,"children":258},{},[259],{"type":48,"tag":107,"props":260,"children":261},{},[262],{"type":53,"value":263},"Certificate type?",{"type":48,"tag":176,"props":265,"children":266},{},[267],{"type":53,"value":268},"CA, Node, Client, UI",{"type":48,"tag":176,"props":270,"children":271},{},[272],{"type":53,"value":273},"Different rotation procedures per type",{"type":48,"tag":149,"props":275,"children":276},{},[277,285,290],{"type":48,"tag":176,"props":278,"children":279},{},[280],{"type":48,"tag":107,"props":281,"children":282},{},[283],{"type":53,"value":284},"Deployment platform?",{"type":48,"tag":176,"props":286,"children":287},{},[288],{"type":53,"value":289},"Bare metal\u002FVMs, Kubernetes (Operator\u002FHelm\u002Fmanual)",{"type":48,"tag":176,"props":291,"children":292},{},[293],{"type":53,"value":294},"Changes rotation tooling",{"type":48,"tag":149,"props":296,"children":297},{},[298,306,311],{"type":48,"tag":176,"props":299,"children":300},{},[301],{"type":48,"tag":107,"props":302,"children":303},{},[304],{"type":53,"value":305},"Certificate tooling?",{"type":48,"tag":176,"props":307,"children":308},{},[309],{"type":53,"value":310},"cockroach cert, openssl, HashiCorp Vault, cert-manager",{"type":48,"tag":176,"props":312,"children":313},{},[314],{"type":53,"value":315},"Determines generation commands",{"type":48,"tag":149,"props":317,"children":318},{},[319,327,332],{"type":48,"tag":176,"props":320,"children":321},{},[322],{"type":48,"tag":107,"props":323,"children":324},{},[325],{"type":53,"value":326},"Is the CA being rotated?",{"type":48,"tag":176,"props":328,"children":329},{},[330],{"type":53,"value":331},"Yes, No",{"type":48,"tag":176,"props":333,"children":334},{},[335],{"type":53,"value":336},"CA rotation requires combined CA approach",{"type":48,"tag":56,"props":338,"children":339},{},[340],{"type":48,"tag":107,"props":341,"children":342},{},[343],{"type":53,"value":344},"If Advanced or BYOC:",{"type":48,"tag":141,"props":346,"children":347},{},[348,366],{"type":48,"tag":145,"props":349,"children":350},{},[351],{"type":48,"tag":149,"props":352,"children":353},{},[354,358,362],{"type":48,"tag":153,"props":355,"children":356},{},[357],{"type":53,"value":157},{"type":48,"tag":153,"props":359,"children":360},{},[361],{"type":53,"value":162},{"type":48,"tag":153,"props":363,"children":364},{},[365],{"type":53,"value":167},{"type":48,"tag":169,"props":367,"children":368},{},[369,389,410],{"type":48,"tag":149,"props":370,"children":371},{},[372,380,384],{"type":48,"tag":176,"props":373,"children":374},{},[375],{"type":48,"tag":107,"props":376,"children":377},{},[378],{"type":53,"value":379},"Is this about CMEK?",{"type":48,"tag":176,"props":381,"children":382},{},[383],{"type":53,"value":331},{"type":48,"tag":176,"props":385,"children":386},{},[387],{"type":53,"value":388},"CMEK is the customer's encryption responsibility; TLS is managed by CRL",{"type":48,"tag":149,"props":390,"children":391},{},[392,400,405],{"type":48,"tag":176,"props":393,"children":394},{},[395],{"type":48,"tag":107,"props":396,"children":397},{},[398],{"type":53,"value":399},"Cloud provider?",{"type":48,"tag":176,"props":401,"children":402},{},[403],{"type":53,"value":404},"AWS, GCP, Azure",{"type":48,"tag":176,"props":406,"children":407},{},[408],{"type":53,"value":409},"Determines KMS service and CLI commands",{"type":48,"tag":149,"props":411,"children":412},{},[413,421,425],{"type":48,"tag":176,"props":414,"children":415},{},[416],{"type":48,"tag":107,"props":417,"children":418},{},[419],{"type":53,"value":420},"CMEK currently enabled?",{"type":48,"tag":176,"props":422,"children":423},{},[424],{"type":53,"value":331},{"type":48,"tag":176,"props":426,"children":427},{},[428],{"type":53,"value":429},"CMEK must be enabled at cluster creation",{"type":48,"tag":56,"props":431,"children":432},{},[433,438],{"type":48,"tag":107,"props":434,"children":435},{},[436],{"type":53,"value":437},"If Standard or Basic:",{"type":53,"value":439}," No context needed — TLS and encryption are fully managed. CMEK is not available on these tiers.",{"type":48,"tag":134,"props":441,"children":443},{"id":442},"context-driven-routing",[444],{"type":53,"value":445},"Context-Driven Routing",{"type":48,"tag":141,"props":447,"children":448},{},[449,465],{"type":48,"tag":145,"props":450,"children":451},{},[452],{"type":48,"tag":149,"props":453,"children":454},{},[455,460],{"type":48,"tag":153,"props":456,"children":457},{},[458],{"type":53,"value":459},"Tier + Scenario",{"type":48,"tag":153,"props":461,"children":462},{},[463],{"type":53,"value":464},"Go To",{"type":48,"tag":169,"props":466,"children":467},{},[468,485,502,519,536],{"type":48,"tag":149,"props":469,"children":470},{},[471,476],{"type":48,"tag":176,"props":472,"children":473},{},[474],{"type":53,"value":475},"Self-Hosted",{"type":48,"tag":176,"props":477,"children":478},{},[479],{"type":48,"tag":115,"props":480,"children":482},{"href":481},"#self-hosted-certificate-management",[483],{"type":53,"value":484},"Self-Hosted Certificate Management",{"type":48,"tag":149,"props":486,"children":487},{},[488,493],{"type":48,"tag":176,"props":489,"children":490},{},[491],{"type":53,"value":492},"Advanced\u002FBYOC + CMEK",{"type":48,"tag":176,"props":494,"children":495},{},[496],{"type":48,"tag":115,"props":497,"children":499},{"href":498},"#cmek-key-management",[500],{"type":53,"value":501},"CMEK Key Management",{"type":48,"tag":149,"props":503,"children":504},{},[505,510],{"type":48,"tag":176,"props":506,"children":507},{},[508],{"type":53,"value":509},"Advanced\u002FBYOC + TLS question",{"type":48,"tag":176,"props":511,"children":512},{},[513],{"type":48,"tag":115,"props":514,"children":516},{"href":515},"#cloud-tls-managed",[517],{"type":53,"value":518},"Cloud TLS (Managed)",{"type":48,"tag":149,"props":520,"children":521},{},[522,527],{"type":48,"tag":176,"props":523,"children":524},{},[525],{"type":53,"value":526},"Standard",{"type":48,"tag":176,"props":528,"children":529},{},[530],{"type":48,"tag":115,"props":531,"children":533},{"href":532},"#fully-managed-encryption",[534],{"type":53,"value":535},"Fully Managed Encryption",{"type":48,"tag":149,"props":537,"children":538},{},[539,544],{"type":48,"tag":176,"props":540,"children":541},{},[542],{"type":53,"value":543},"Basic",{"type":48,"tag":176,"props":545,"children":546},{},[547],{"type":48,"tag":115,"props":548,"children":549},{"href":532},[550],{"type":53,"value":535},{"type":48,"tag":124,"props":552,"children":553},{},[],{"type":48,"tag":62,"props":555,"children":557},{"id":556},"self-hosted-certificate-management",[558],{"type":53,"value":484},{"type":48,"tag":56,"props":560,"children":561},{},[562,567],{"type":48,"tag":107,"props":563,"children":564},{},[565],{"type":53,"value":566},"Applies when:",{"type":53,"value":568}," Tier = Self-Hosted",{"type":48,"tag":134,"props":570,"children":572},{"id":571},"monitor-certificate-expiry",[573],{"type":53,"value":574},"Monitor Certificate Expiry",{"type":48,"tag":56,"props":576,"children":577},{},[578],{"type":53,"value":579},"No production-safe SQL view exposes certificate expiration. Use one of:",{"type":48,"tag":581,"props":582,"children":587},"pre",{"className":583,"code":584,"language":585,"meta":586,"style":586},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Inspect certs locally on each node\ncockroach cert list --certs-dir=\u003Ccerts-dir>\n\n# Or read a specific cert file\nopenssl x509 -in \u003Ccerts-dir>\u002Fnode.crt -noout -enddate\n\n# Or scrape the per-node Prometheus endpoint (UNIX seconds for ca, node, client_ca, ui_ca)\ncurl -ks https:\u002F\u002F\u003Cnode>:8080\u002F_status\u002Fvars | grep '^security_certificate_expiration_'\n","bash","",[588],{"type":48,"tag":589,"props":590,"children":591},"code",{"__ignoreMap":586},[592,604,645,654,663,718,726,735],{"type":48,"tag":593,"props":594,"children":597},"span",{"class":595,"line":596},"line",1,[598],{"type":48,"tag":593,"props":599,"children":601},{"style":600},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[602],{"type":53,"value":603},"# Inspect certs locally on each node\n",{"type":48,"tag":593,"props":605,"children":606},{"class":595,"line":29},[607,613,619,624,629,635,640],{"type":48,"tag":593,"props":608,"children":610},{"style":609},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[611],{"type":53,"value":612},"cockroach",{"type":48,"tag":593,"props":614,"children":616},{"style":615},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[617],{"type":53,"value":618}," cert",{"type":48,"tag":593,"props":620,"children":621},{"style":615},[622],{"type":53,"value":623}," list",{"type":48,"tag":593,"props":625,"children":626},{"style":615},[627],{"type":53,"value":628}," --certs-dir=",{"type":48,"tag":593,"props":630,"children":632},{"style":631},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[633],{"type":53,"value":634},"\u003C",{"type":48,"tag":593,"props":636,"children":637},{"style":615},[638],{"type":53,"value":639},"certs-dir",{"type":48,"tag":593,"props":641,"children":642},{"style":631},[643],{"type":53,"value":644},">\n",{"type":48,"tag":593,"props":646,"children":647},{"class":595,"line":25},[648],{"type":48,"tag":593,"props":649,"children":651},{"emptyLinePlaceholder":650},true,[652],{"type":53,"value":653},"\n",{"type":48,"tag":593,"props":655,"children":657},{"class":595,"line":656},4,[658],{"type":48,"tag":593,"props":659,"children":660},{"style":600},[661],{"type":53,"value":662},"# Or read a specific cert file\n",{"type":48,"tag":593,"props":664,"children":666},{"class":595,"line":665},5,[667,672,677,682,687,692,698,703,708,713],{"type":48,"tag":593,"props":668,"children":669},{"style":609},[670],{"type":53,"value":671},"openssl",{"type":48,"tag":593,"props":673,"children":674},{"style":615},[675],{"type":53,"value":676}," x509",{"type":48,"tag":593,"props":678,"children":679},{"style":615},[680],{"type":53,"value":681}," -in",{"type":48,"tag":593,"props":683,"children":684},{"style":631},[685],{"type":53,"value":686}," \u003C",{"type":48,"tag":593,"props":688,"children":689},{"style":615},[690],{"type":53,"value":691},"certs-di",{"type":48,"tag":593,"props":693,"children":695},{"style":694},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[696],{"type":53,"value":697},"r",{"type":48,"tag":593,"props":699,"children":700},{"style":631},[701],{"type":53,"value":702},">",{"type":48,"tag":593,"props":704,"children":705},{"style":615},[706],{"type":53,"value":707},"\u002Fnode.crt",{"type":48,"tag":593,"props":709,"children":710},{"style":615},[711],{"type":53,"value":712}," -noout",{"type":48,"tag":593,"props":714,"children":715},{"style":615},[716],{"type":53,"value":717}," -enddate\n",{"type":48,"tag":593,"props":719,"children":721},{"class":595,"line":720},6,[722],{"type":48,"tag":593,"props":723,"children":724},{"emptyLinePlaceholder":650},[725],{"type":53,"value":653},{"type":48,"tag":593,"props":727,"children":729},{"class":595,"line":728},7,[730],{"type":48,"tag":593,"props":731,"children":732},{"style":600},[733],{"type":53,"value":734},"# Or scrape the per-node Prometheus endpoint (UNIX seconds for ca, node, client_ca, ui_ca)\n",{"type":48,"tag":593,"props":736,"children":738},{"class":595,"line":737},8,[739,744,749,754,758,763,768,772,777,782,787,792,797],{"type":48,"tag":593,"props":740,"children":741},{"style":609},[742],{"type":53,"value":743},"curl",{"type":48,"tag":593,"props":745,"children":746},{"style":615},[747],{"type":53,"value":748}," -ks",{"type":48,"tag":593,"props":750,"children":751},{"style":615},[752],{"type":53,"value":753}," https:\u002F\u002F",{"type":48,"tag":593,"props":755,"children":756},{"style":631},[757],{"type":53,"value":634},{"type":48,"tag":593,"props":759,"children":760},{"style":615},[761],{"type":53,"value":762},"nod",{"type":48,"tag":593,"props":764,"children":765},{"style":694},[766],{"type":53,"value":767},"e",{"type":48,"tag":593,"props":769,"children":770},{"style":631},[771],{"type":53,"value":702},{"type":48,"tag":593,"props":773,"children":774},{"style":615},[775],{"type":53,"value":776},":8080\u002F_status\u002Fvars",{"type":48,"tag":593,"props":778,"children":779},{"style":631},[780],{"type":53,"value":781}," |",{"type":48,"tag":593,"props":783,"children":784},{"style":609},[785],{"type":53,"value":786}," grep",{"type":48,"tag":593,"props":788,"children":789},{"style":631},[790],{"type":53,"value":791}," '",{"type":48,"tag":593,"props":793,"children":794},{"style":615},[795],{"type":53,"value":796},"^security_certificate_expiration_",{"type":48,"tag":593,"props":798,"children":799},{"style":631},[800],{"type":53,"value":801},"'\n",{"type":48,"tag":56,"props":803,"children":804},{},[805],{"type":53,"value":806},"Alert thresholds: CA \u003C 1 year = plan rotation. Node \u003C 90 days = schedule rotation. Node \u003C 30 days = rotate immediately.",{"type":48,"tag":134,"props":808,"children":810},{"id":809},"rotate-node-certificates-same-ca",[811],{"type":53,"value":812},"Rotate Node Certificates (Same CA)",{"type":48,"tag":581,"props":814,"children":816},{"className":583,"code":815,"language":585,"meta":586,"style":586},"cockroach cert create-node \u003Chostname> \u003Cip> \u003Clb-hostname> \u003Clb-ip> localhost 127.0.0.1 \\\n  --certs-dir=\u003Ccerts-dir> --ca-key=\u003Cca-key-path> --overwrite\n",[817],{"type":48,"tag":589,"props":818,"children":819},{"__ignoreMap":586},[820,920],{"type":48,"tag":593,"props":821,"children":822},{"class":595,"line":596},[823,827,831,836,840,845,849,853,857,862,866,870,874,879,883,887,891,896,900,904,909,915],{"type":48,"tag":593,"props":824,"children":825},{"style":609},[826],{"type":53,"value":612},{"type":48,"tag":593,"props":828,"children":829},{"style":615},[830],{"type":53,"value":618},{"type":48,"tag":593,"props":832,"children":833},{"style":615},[834],{"type":53,"value":835}," create-node",{"type":48,"tag":593,"props":837,"children":838},{"style":631},[839],{"type":53,"value":686},{"type":48,"tag":593,"props":841,"children":842},{"style":615},[843],{"type":53,"value":844},"hostnam",{"type":48,"tag":593,"props":846,"children":847},{"style":694},[848],{"type":53,"value":767},{"type":48,"tag":593,"props":850,"children":851},{"style":631},[852],{"type":53,"value":702},{"type":48,"tag":593,"props":854,"children":855},{"style":631},[856],{"type":53,"value":686},{"type":48,"tag":593,"props":858,"children":859},{"style":615},[860],{"type":53,"value":861},"i",{"type":48,"tag":593,"props":863,"children":864},{"style":694},[865],{"type":53,"value":56},{"type":48,"tag":593,"props":867,"children":868},{"style":631},[869],{"type":53,"value":702},{"type":48,"tag":593,"props":871,"children":872},{"style":631},[873],{"type":53,"value":686},{"type":48,"tag":593,"props":875,"children":876},{"style":615},[877],{"type":53,"value":878},"lb-hostnam",{"type":48,"tag":593,"props":880,"children":881},{"style":694},[882],{"type":53,"value":767},{"type":48,"tag":593,"props":884,"children":885},{"style":631},[886],{"type":53,"value":702},{"type":48,"tag":593,"props":888,"children":889},{"style":631},[890],{"type":53,"value":686},{"type":48,"tag":593,"props":892,"children":893},{"style":615},[894],{"type":53,"value":895},"lb-i",{"type":48,"tag":593,"props":897,"children":898},{"style":694},[899],{"type":53,"value":56},{"type":48,"tag":593,"props":901,"children":902},{"style":631},[903],{"type":53,"value":702},{"type":48,"tag":593,"props":905,"children":906},{"style":615},[907],{"type":53,"value":908}," localhost",{"type":48,"tag":593,"props":910,"children":912},{"style":911},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[913],{"type":53,"value":914}," 127.0.0.1",{"type":48,"tag":593,"props":916,"children":917},{"style":694},[918],{"type":53,"value":919}," \\\n",{"type":48,"tag":593,"props":921,"children":922},{"class":595,"line":29},[923,928,932,936,940,945,949,954,958],{"type":48,"tag":593,"props":924,"children":925},{"style":615},[926],{"type":53,"value":927},"  --certs-dir=",{"type":48,"tag":593,"props":929,"children":930},{"style":631},[931],{"type":53,"value":634},{"type":48,"tag":593,"props":933,"children":934},{"style":615},[935],{"type":53,"value":639},{"type":48,"tag":593,"props":937,"children":938},{"style":631},[939],{"type":53,"value":702},{"type":48,"tag":593,"props":941,"children":942},{"style":615},[943],{"type":53,"value":944}," --ca-key=",{"type":48,"tag":593,"props":946,"children":947},{"style":631},[948],{"type":53,"value":634},{"type":48,"tag":593,"props":950,"children":951},{"style":615},[952],{"type":53,"value":953},"ca-key-path",{"type":48,"tag":593,"props":955,"children":956},{"style":631},[957],{"type":53,"value":702},{"type":48,"tag":593,"props":959,"children":960},{"style":615},[961],{"type":53,"value":962}," --overwrite\n",{"type":48,"tag":56,"props":964,"children":965},{},[966,968,974],{"type":53,"value":967},"Deploy to node, set ",{"type":48,"tag":589,"props":969,"children":971},{"className":970},[],[972],{"type":53,"value":973},"chmod 0600",{"type":53,"value":975}," on key file. CockroachDB auto-detects new certs — no restart required.",{"type":48,"tag":56,"props":977,"children":978},{},[979,981,987],{"type":53,"value":980},"See ",{"type":48,"tag":115,"props":982,"children":984},{"href":983},"references\u002Frotation-procedures.md",[985],{"type":53,"value":986},"rotation-procedures reference",{"type":53,"value":988}," for detailed steps and verification.",{"type":48,"tag":134,"props":990,"children":992},{"id":991},"rotate-ca-certificate",[993],{"type":53,"value":994},"Rotate CA Certificate",{"type":48,"tag":56,"props":996,"children":997},{},[998],{"type":53,"value":999},"CA rotation requires a combined certificate (new + old) for seamless trust transition:",{"type":48,"tag":1001,"props":1002,"children":1003},"ol",{},[1004,1009,1020,1025,1030],{"type":48,"tag":73,"props":1005,"children":1006},{},[1007],{"type":53,"value":1008},"Generate new CA key and certificate",{"type":48,"tag":73,"props":1010,"children":1011},{},[1012,1014],{"type":53,"value":1013},"Create combined CA file: ",{"type":48,"tag":589,"props":1015,"children":1017},{"className":1016},[],[1018],{"type":53,"value":1019},"cat new-ca.crt old-ca.crt > ca.crt",{"type":48,"tag":73,"props":1021,"children":1022},{},[1023],{"type":53,"value":1024},"Deploy combined CA to all nodes",{"type":48,"tag":73,"props":1026,"children":1027},{},[1028],{"type":53,"value":1029},"Re-issue node and client certificates signed by the new CA",{"type":48,"tag":73,"props":1031,"children":1032},{},[1033],{"type":53,"value":1034},"After all entities use new-CA-signed certs, remove old CA from combined file",{"type":48,"tag":56,"props":1036,"children":1037},{},[1038,1039,1043],{"type":53,"value":980},{"type":48,"tag":115,"props":1040,"children":1041},{"href":983},[1042],{"type":53,"value":986},{"type":53,"value":1044}," for the full CA rotation procedure.",{"type":48,"tag":134,"props":1046,"children":1048},{"id":1047},"kubernetes-certificate-management",[1049],{"type":53,"value":1050},"Kubernetes Certificate Management",{"type":48,"tag":69,"props":1052,"children":1053},{},[1054,1071],{"type":48,"tag":73,"props":1055,"children":1056},{},[1057,1062,1064,1070],{"type":48,"tag":107,"props":1058,"children":1059},{},[1060],{"type":53,"value":1061},"CockroachDB Operator:",{"type":53,"value":1063}," Self-signer rotates automatically. Configure via ",{"type":48,"tag":589,"props":1065,"children":1067},{"className":1066},[],[1068],{"type":53,"value":1069},"tls.certs.selfSigner.rotateCerts",{"type":53,"value":122},{"type":48,"tag":73,"props":1072,"children":1073},{},[1074,1079],{"type":48,"tag":107,"props":1075,"children":1076},{},[1077],{"type":53,"value":1078},"cert-manager:",{"type":53,"value":1080}," Auto-renews. Pods may need restart to pick up new certs.",{"type":48,"tag":56,"props":1082,"children":1083},{},[1084,1085,1091],{"type":53,"value":980},{"type":48,"tag":115,"props":1086,"children":1088},{"href":1087},"references\u002Fkubernetes-certs.md",[1089],{"type":53,"value":1090},"kubernetes-certs reference",{"type":53,"value":1092}," for detailed Kubernetes procedures.",{"type":48,"tag":124,"props":1094,"children":1095},{},[],{"type":48,"tag":62,"props":1097,"children":1099},{"id":1098},"cmek-key-management",[1100],{"type":53,"value":501},{"type":48,"tag":56,"props":1102,"children":1103},{},[1104,1108],{"type":48,"tag":107,"props":1105,"children":1106},{},[1107],{"type":53,"value":566},{"type":53,"value":1109}," Tier = Advanced or BYOC, CMEK enabled",{"type":48,"tag":134,"props":1111,"children":1113},{"id":1112},"what-is-cmek",[1114],{"type":53,"value":1115},"What Is CMEK",{"type":48,"tag":56,"props":1117,"children":1118},{},[1119],{"type":53,"value":1120},"Customer-Managed Encryption Keys wrap CockroachDB's data-at-rest encryption with a key stored in your cloud provider's KMS. CockroachDB Cloud never has access to the CMEK itself.",{"type":48,"tag":56,"props":1122,"children":1123},{},[1124,1126],{"type":53,"value":1125},"CMEK requires an Advanced cluster with advanced security features enabled at cluster creation. It cannot be enabled retroactively. ",{"type":48,"tag":107,"props":1127,"children":1128},{},[1129],{"type":53,"value":1130},"CMEK is not available on Standard or Basic.",{"type":48,"tag":134,"props":1132,"children":1134},{"id":1133},"check-cmek-status",[1135],{"type":53,"value":1136},"Check CMEK Status",{"type":48,"tag":581,"props":1138,"children":1140},{"className":583,"code":1139,"language":585,"meta":586,"style":586},"curl -s -H \"Authorization: Bearer $COCKROACH_API_KEY\" \\\n  \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fcmek\" | jq '.'\n",[1141],{"type":48,"tag":589,"props":1142,"children":1143},{"__ignoreMap":586},[1144,1185],{"type":48,"tag":593,"props":1145,"children":1146},{"class":595,"line":596},[1147,1151,1156,1161,1166,1171,1176,1181],{"type":48,"tag":593,"props":1148,"children":1149},{"style":609},[1150],{"type":53,"value":743},{"type":48,"tag":593,"props":1152,"children":1153},{"style":615},[1154],{"type":53,"value":1155}," -s",{"type":48,"tag":593,"props":1157,"children":1158},{"style":615},[1159],{"type":53,"value":1160}," -H",{"type":48,"tag":593,"props":1162,"children":1163},{"style":631},[1164],{"type":53,"value":1165}," \"",{"type":48,"tag":593,"props":1167,"children":1168},{"style":615},[1169],{"type":53,"value":1170},"Authorization: Bearer ",{"type":48,"tag":593,"props":1172,"children":1173},{"style":694},[1174],{"type":53,"value":1175},"$COCKROACH_API_KEY",{"type":48,"tag":593,"props":1177,"children":1178},{"style":631},[1179],{"type":53,"value":1180},"\"",{"type":48,"tag":593,"props":1182,"children":1183},{"style":694},[1184],{"type":53,"value":919},{"type":48,"tag":593,"props":1186,"children":1187},{"class":595,"line":29},[1188,1193,1198,1202,1206,1211,1215,1219],{"type":48,"tag":593,"props":1189,"children":1190},{"style":631},[1191],{"type":53,"value":1192},"  \"",{"type":48,"tag":593,"props":1194,"children":1195},{"style":615},[1196],{"type":53,"value":1197},"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fcmek",{"type":48,"tag":593,"props":1199,"children":1200},{"style":631},[1201],{"type":53,"value":1180},{"type":48,"tag":593,"props":1203,"children":1204},{"style":631},[1205],{"type":53,"value":781},{"type":48,"tag":593,"props":1207,"children":1208},{"style":609},[1209],{"type":53,"value":1210}," jq",{"type":48,"tag":593,"props":1212,"children":1213},{"style":631},[1214],{"type":53,"value":791},{"type":48,"tag":593,"props":1216,"children":1217},{"style":615},[1218],{"type":53,"value":122},{"type":48,"tag":593,"props":1220,"children":1221},{"style":631},[1222],{"type":53,"value":801},{"type":48,"tag":56,"props":1224,"children":1225},{},[1226],{"type":53,"value":1227},"Or: Cloud Console → Cluster → Security → Encryption.",{"type":48,"tag":134,"props":1229,"children":1231},{"id":1230},"rotate-cmek-key",[1232],{"type":53,"value":1233},"Rotate CMEK Key",{"type":48,"tag":56,"props":1235,"children":1236},{},[1237],{"type":53,"value":1238},"Rotate the key in your cloud provider's KMS. CockroachDB Cloud automatically uses the new key version. No cluster downtime.",{"type":48,"tag":56,"props":1240,"children":1241},{},[1242,1243,1249],{"type":53,"value":980},{"type":48,"tag":115,"props":1244,"children":1246},{"href":1245},"references\u002Fcmek-procedures.md",[1247],{"type":53,"value":1248},"cmek-procedures reference",{"type":53,"value":1250}," for provider-specific KMS rotation commands (AWS KMS, GCP Cloud KMS, Azure Key Vault) and IAM audit procedures.",{"type":48,"tag":134,"props":1252,"children":1254},{"id":1253},"emergency-revoke-cmek-key",[1255],{"type":53,"value":1256},"Emergency: Revoke CMEK Key",{"type":48,"tag":56,"props":1258,"children":1259},{},[1260,1262,1267],{"type":53,"value":1261},"Revoking the CMEK key makes cluster data ",{"type":48,"tag":107,"props":1263,"children":1264},{},[1265],{"type":53,"value":1266},"permanently inaccessible",{"type":53,"value":1268}," unless the key is restored within your KMS provider's grace period.",{"type":48,"tag":56,"props":1270,"children":1271},{},[1272,1277],{"type":48,"tag":107,"props":1273,"children":1274},{},[1275],{"type":53,"value":1276},"Only use as an emergency kill switch.",{"type":53,"value":1278}," This may be irreversible.",{"type":48,"tag":124,"props":1280,"children":1281},{},[],{"type":48,"tag":62,"props":1283,"children":1285},{"id":1284},"cloud-tls-managed",[1286],{"type":53,"value":518},{"type":48,"tag":56,"props":1288,"children":1289},{},[1290,1294],{"type":48,"tag":107,"props":1291,"children":1292},{},[1293],{"type":53,"value":566},{"type":53,"value":1295}," Tier = Advanced or BYOC, question is about TLS (not CMEK)",{"type":48,"tag":56,"props":1297,"children":1298},{},[1299],{"type":53,"value":1300},"TLS certificates are fully managed by Cockroach Labs on Advanced and BYOC:",{"type":48,"tag":69,"props":1302,"children":1303},{},[1304,1309,1314],{"type":48,"tag":73,"props":1305,"children":1306},{},[1307],{"type":53,"value":1308},"Provisioning, rotation, and renewal are automatic",{"type":48,"tag":73,"props":1310,"children":1311},{},[1312],{"type":53,"value":1313},"No customer action needed",{"type":48,"tag":73,"props":1315,"children":1316},{},[1317],{"type":53,"value":1318},"Certificate health is monitored by CRL",{"type":48,"tag":56,"props":1320,"children":1321},{},[1322,1327],{"type":48,"tag":107,"props":1323,"children":1324},{},[1325],{"type":53,"value":1326},"Client certificates:",{"type":53,"value":1328}," You manage your own client-side certificates for application connections. These are standard PostgreSQL client certificates.",{"type":48,"tag":124,"props":1330,"children":1331},{},[],{"type":48,"tag":62,"props":1333,"children":1335},{"id":1334},"fully-managed-encryption",[1336],{"type":53,"value":535},{"type":48,"tag":56,"props":1338,"children":1339},{},[1340,1344],{"type":48,"tag":107,"props":1341,"children":1342},{},[1343],{"type":53,"value":566},{"type":53,"value":1345}," Tier = Standard or Basic",{"type":48,"tag":56,"props":1347,"children":1348},{},[1349],{"type":53,"value":1350},"TLS certificates and data-at-rest encryption are fully managed by Cockroach Labs.",{"type":48,"tag":69,"props":1352,"children":1353},{},[1354,1359,1364,1369],{"type":48,"tag":73,"props":1355,"children":1356},{},[1357],{"type":53,"value":1358},"No certificate visibility or rotation responsibility",{"type":48,"tag":73,"props":1360,"children":1361},{},[1362],{"type":53,"value":1363},"Encryption in transit is always enabled",{"type":48,"tag":73,"props":1365,"children":1366},{},[1367],{"type":53,"value":1368},"Encryption at rest is always enabled",{"type":48,"tag":73,"props":1370,"children":1371},{},[1372],{"type":53,"value":1373},"CMEK is not available on these tiers",{"type":48,"tag":56,"props":1375,"children":1376},{},[1377,1382],{"type":48,"tag":107,"props":1378,"children":1379},{},[1380],{"type":53,"value":1381},"If CMEK is required:",{"type":53,"value":1383}," Upgrade to Advanced.",{"type":48,"tag":124,"props":1385,"children":1386},{},[],{"type":48,"tag":62,"props":1388,"children":1390},{"id":1389},"safety-considerations",[1391],{"type":53,"value":1392},"Safety Considerations",{"type":48,"tag":56,"props":1394,"children":1395},{},[1396],{"type":48,"tag":107,"props":1397,"children":1398},{},[1399],{"type":53,"value":1400},"Read-only monitoring queries are safe on all tiers.",{"type":48,"tag":56,"props":1402,"children":1403},{},[1404],{"type":48,"tag":107,"props":1405,"children":1406},{},[1407],{"type":53,"value":1408},"Self-Hosted certificate operations:",{"type":48,"tag":69,"props":1410,"children":1411},{},[1412,1417,1422,1427,1432],{"type":48,"tag":73,"props":1413,"children":1414},{},[1415],{"type":53,"value":1416},"Always backup existing certificates before rotation",{"type":48,"tag":73,"props":1418,"children":1419},{},[1420],{"type":53,"value":1421},"Use combined CA approach — never abruptly replace the CA",{"type":48,"tag":73,"props":1423,"children":1424},{},[1425],{"type":53,"value":1426},"Verify SAN entries include ALL hostnames, IPs, and load balancer addresses",{"type":48,"tag":73,"props":1428,"children":1429},{},[1430],{"type":53,"value":1431},"CA key must be stored separately from node certificates",{"type":48,"tag":73,"props":1433,"children":1434},{},[1435],{"type":53,"value":1436},"File permissions: key files must be mode 0600, owned by cockroach process user",{"type":48,"tag":56,"props":1438,"children":1439},{},[1440],{"type":48,"tag":107,"props":1441,"children":1442},{},[1443],{"type":53,"value":1444},"CMEK operations (Advanced\u002FBYOC):",{"type":48,"tag":69,"props":1446,"children":1447},{},[1448,1453,1458],{"type":48,"tag":73,"props":1449,"children":1450},{},[1451],{"type":53,"value":1452},"CMEK key revocation renders data permanently inaccessible",{"type":48,"tag":73,"props":1454,"children":1455},{},[1456],{"type":53,"value":1457},"Verify IAM permissions before and after KMS key rotation",{"type":48,"tag":73,"props":1459,"children":1460},{},[1461],{"type":53,"value":1462},"Test CMEK rotation in a staging cluster first",{"type":48,"tag":56,"props":1464,"children":1465},{},[1466,1467,1473],{"type":53,"value":980},{"type":48,"tag":115,"props":1468,"children":1470},{"href":1469},"references\u002Fsafety-guide.md",[1471],{"type":53,"value":1472},"safety-guide reference",{"type":53,"value":1474}," for detailed risk matrix.",{"type":48,"tag":62,"props":1476,"children":1478},{"id":1477},"troubleshooting",[1479],{"type":53,"value":1480},"Troubleshooting",{"type":48,"tag":141,"props":1482,"children":1483},{},[1484,1505],{"type":48,"tag":145,"props":1485,"children":1486},{},[1487],{"type":48,"tag":149,"props":1488,"children":1489},{},[1490,1495,1500],{"type":48,"tag":153,"props":1491,"children":1492},{},[1493],{"type":53,"value":1494},"Issue",{"type":48,"tag":153,"props":1496,"children":1497},{},[1498],{"type":53,"value":1499},"Tier",{"type":48,"tag":153,"props":1501,"children":1502},{},[1503],{"type":53,"value":1504},"Fix",{"type":48,"tag":169,"props":1506,"children":1507},{},[1508,1526,1543,1560,1577,1595],{"type":48,"tag":149,"props":1509,"children":1510},{},[1511,1516,1521],{"type":48,"tag":176,"props":1512,"children":1513},{},[1514],{"type":53,"value":1515},"Cert metric NULL",{"type":48,"tag":176,"props":1517,"children":1518},{},[1519],{"type":53,"value":1520},"SH",{"type":48,"tag":176,"props":1522,"children":1523},{},[1524],{"type":53,"value":1525},"Verify cluster is in secure mode",{"type":48,"tag":149,"props":1527,"children":1528},{},[1529,1534,1538],{"type":48,"tag":176,"props":1530,"children":1531},{},[1532],{"type":53,"value":1533},"New cert not detected",{"type":48,"tag":176,"props":1535,"children":1536},{},[1537],{"type":53,"value":1520},{"type":48,"tag":176,"props":1539,"children":1540},{},[1541],{"type":53,"value":1542},"Check file permissions (0600, correct owner)",{"type":48,"tag":149,"props":1544,"children":1545},{},[1546,1551,1555],{"type":48,"tag":176,"props":1547,"children":1548},{},[1549],{"type":53,"value":1550},"\"unknown authority\" error",{"type":48,"tag":176,"props":1552,"children":1553},{},[1554],{"type":53,"value":1520},{"type":48,"tag":176,"props":1556,"children":1557},{},[1558],{"type":53,"value":1559},"Deploy combined CA (new + old)",{"type":48,"tag":149,"props":1561,"children":1562},{},[1563,1568,1572],{"type":48,"tag":176,"props":1564,"children":1565},{},[1566],{"type":53,"value":1567},"Connection failures after rotation",{"type":48,"tag":176,"props":1569,"children":1570},{},[1571],{"type":53,"value":1520},{"type":48,"tag":176,"props":1573,"children":1574},{},[1575],{"type":53,"value":1576},"Check SAN entries cover all hostnames\u002FIPs",{"type":48,"tag":149,"props":1578,"children":1579},{},[1580,1585,1590],{"type":48,"tag":176,"props":1581,"children":1582},{},[1583],{"type":53,"value":1584},"CMEK access denied",{"type":48,"tag":176,"props":1586,"children":1587},{},[1588],{"type":53,"value":1589},"ADV\u002FBYOC",{"type":48,"tag":176,"props":1591,"children":1592},{},[1593],{"type":53,"value":1594},"Verify KMS key policy and IAM permissions",{"type":48,"tag":149,"props":1596,"children":1597},{},[1598,1603,1607],{"type":48,"tag":176,"props":1599,"children":1600},{},[1601],{"type":53,"value":1602},"Cannot enable CMEK",{"type":48,"tag":176,"props":1604,"children":1605},{},[1606],{"type":53,"value":1589},{"type":48,"tag":176,"props":1608,"children":1609},{},[1610],{"type":53,"value":429},{"type":48,"tag":62,"props":1612,"children":1614},{"id":1613},"references",[1615],{"type":53,"value":1616},"References",{"type":48,"tag":56,"props":1618,"children":1619},{},[1620],{"type":48,"tag":107,"props":1621,"children":1622},{},[1623],{"type":53,"value":1624},"Skill references:",{"type":48,"tag":69,"props":1626,"children":1627},{},[1628,1636,1644,1652],{"type":48,"tag":73,"props":1629,"children":1630},{},[1631],{"type":48,"tag":115,"props":1632,"children":1633},{"href":983},[1634],{"type":53,"value":1635},"Certificate rotation procedures",{"type":48,"tag":73,"props":1637,"children":1638},{},[1639],{"type":48,"tag":115,"props":1640,"children":1641},{"href":1087},[1642],{"type":53,"value":1643},"Kubernetes certificate management",{"type":48,"tag":73,"props":1645,"children":1646},{},[1647],{"type":48,"tag":115,"props":1648,"children":1649},{"href":1245},[1650],{"type":53,"value":1651},"CMEK procedures by cloud provider",{"type":48,"tag":73,"props":1653,"children":1654},{},[1655],{"type":48,"tag":115,"props":1656,"children":1657},{"href":1469},[1658],{"type":53,"value":1659},"Safety guide",{"type":48,"tag":56,"props":1661,"children":1662},{},[1663],{"type":48,"tag":107,"props":1664,"children":1665},{},[1666],{"type":53,"value":1667},"Related skills:",{"type":48,"tag":69,"props":1669,"children":1670},{},[1671,1678],{"type":48,"tag":73,"props":1672,"children":1673},{},[1674],{"type":48,"tag":115,"props":1675,"children":1676},{"href":117},[1677],{"type":53,"value":120},{"type":48,"tag":73,"props":1679,"children":1680},{},[1681],{"type":48,"tag":115,"props":1682,"children":1684},{"href":1683},"..\u002Fmanaging-cluster-settings\u002FSKILL.md",[1685],{"type":53,"value":1686},"managing-cluster-settings",{"type":48,"tag":56,"props":1688,"children":1689},{},[1690],{"type":48,"tag":107,"props":1691,"children":1692},{},[1693],{"type":53,"value":1694},"Official CockroachDB Documentation:",{"type":48,"tag":69,"props":1696,"children":1697},{},[1698,1709,1719,1729],{"type":48,"tag":73,"props":1699,"children":1700},{},[1701],{"type":48,"tag":115,"props":1702,"children":1706},{"href":1703,"rel":1704},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frotate-certificates",[1705],"nofollow",[1707],{"type":53,"value":1708},"Rotate Security Certificates",{"type":48,"tag":73,"props":1710,"children":1711},{},[1712],{"type":48,"tag":115,"props":1713,"children":1716},{"href":1714,"rel":1715},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcockroach-cert",[1705],[1717],{"type":53,"value":1718},"cockroach cert",{"type":48,"tag":73,"props":1720,"children":1721},{},[1722],{"type":48,"tag":115,"props":1723,"children":1726},{"href":1724,"rel":1725},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Ftransport-layer-security",[1705],[1727],{"type":53,"value":1728},"TLS and PKI Reference",{"type":48,"tag":73,"props":1730,"children":1731},{},[1732],{"type":48,"tag":115,"props":1733,"children":1736},{"href":1734,"rel":1735},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fmanaging-cmek",[1705],[1737],{"type":53,"value":1738},"Manage CMEK",{"type":48,"tag":1740,"props":1741,"children":1742},"style",{},[1743],{"type":53,"value":1744},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1746,"total":1840},[1747,1761,1776,1791,1804,1817,1830],{"slug":1748,"name":1748,"fn":1749,"description":1750,"org":1751,"tags":1752,"stars":25,"repoUrl":26,"updatedAt":1760},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1753,1754,1757],{"name":20,"slug":21,"type":15},{"name":1755,"slug":1756,"type":15},"Monitoring","monitoring",{"name":1758,"slug":1759,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":1762,"name":1762,"fn":1763,"description":1764,"org":1765,"tags":1766,"stars":25,"repoUrl":26,"updatedAt":1775},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1767,1770,1771,1772],{"name":1768,"slug":1769,"type":15},"Data Modeling","data-modeling",{"name":20,"slug":21,"type":15},{"name":1758,"slug":1759,"type":15},{"name":1773,"slug":1774,"type":15},"SQL","sql","2026-07-12T07:57:22.763788",{"slug":1777,"name":1777,"fn":1778,"description":1779,"org":1780,"tags":1781,"stars":25,"repoUrl":26,"updatedAt":1790},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1782,1785,1788,1789],{"name":1783,"slug":1784,"type":15},"Audit","audit",{"name":1786,"slug":1787,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":1792,"name":1792,"fn":1793,"description":1794,"org":1795,"tags":1796,"stars":25,"repoUrl":26,"updatedAt":1803},"auditing-cloud-cluster-security","audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1797,1798,1799,1802],{"name":1783,"slug":1784,"type":15},{"name":20,"slug":21,"type":15},{"name":1800,"slug":1801,"type":15},"Operations","operations",{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":1805,"name":1805,"fn":1806,"description":1807,"org":1808,"tags":1809,"stars":25,"repoUrl":26,"updatedAt":1816},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1810,1811,1814,1815],{"name":1783,"slug":1784,"type":15},{"name":1812,"slug":1813,"type":15},"Data Analysis","data-analysis",{"name":20,"slug":21,"type":15},{"name":1758,"slug":1759,"type":15},"2026-07-12T07:57:16.190081",{"slug":1818,"name":1818,"fn":1819,"description":1820,"org":1821,"tags":1822,"stars":25,"repoUrl":26,"updatedAt":1829},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1823,1824,1827,1828],{"name":20,"slug":21,"type":15},{"name":1825,"slug":1826,"type":15},"Engineering","engineering",{"name":1758,"slug":1759,"type":15},{"name":1773,"slug":1774,"type":15},"2026-07-12T07:57:26.543278",{"slug":1831,"name":1831,"fn":1832,"description":1833,"org":1834,"tags":1835,"stars":25,"repoUrl":26,"updatedAt":1839},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1836,1837,1838],{"name":20,"slug":21,"type":15},{"name":1758,"slug":1759,"type":15},{"name":1773,"slug":1774,"type":15},"2026-07-25T05:31:22.562808",34,{"items":1842,"total":1960},[1843,1858,1872,1887,1898,1908,1919,1925,1932,1939,1946,1953],{"slug":1844,"name":1844,"fn":1845,"description":1846,"org":1847,"tags":1848,"stars":1855,"repoUrl":1856,"updatedAt":1857},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1849,1850,1853,1854],{"name":20,"slug":21,"type":15},{"name":1851,"slug":1852,"type":15},"Incident Response","incident-response",{"name":23,"slug":24,"type":15},{"name":1755,"slug":1756,"type":15},105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":1859,"name":1859,"fn":1860,"description":1861,"org":1862,"tags":1863,"stars":1855,"repoUrl":1856,"updatedAt":1871},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1864,1867,1870],{"name":1865,"slug":1866,"type":15},"Deployment","deployment",{"name":1868,"slug":1869,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":1873,"name":1873,"fn":1874,"description":1875,"org":1876,"tags":1877,"stars":1855,"repoUrl":1856,"updatedAt":1886},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1878,1879,1882,1883],{"name":20,"slug":21,"type":15},{"name":1880,"slug":1881,"type":15},"Debugging","debugging",{"name":23,"slug":24,"type":15},{"name":1884,"slug":1885,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":1888,"name":1888,"fn":1889,"description":1890,"org":1891,"tags":1892,"stars":1855,"repoUrl":1856,"updatedAt":1897},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1893,1894,1895,1896],{"name":20,"slug":21,"type":15},{"name":1880,"slug":1881,"type":15},{"name":1865,"slug":1866,"type":15},{"name":23,"slug":24,"type":15},"2026-07-12T07:57:24.018818",{"slug":1899,"name":1899,"fn":1900,"description":1901,"org":1902,"tags":1903,"stars":1855,"repoUrl":1856,"updatedAt":1907},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1904,1905,1906],{"name":20,"slug":21,"type":15},{"name":1865,"slug":1866,"type":15},{"name":23,"slug":24,"type":15},"2026-07-12T07:56:45.777567",{"slug":1909,"name":1909,"fn":1910,"description":1911,"org":1912,"tags":1913,"stars":1855,"repoUrl":1856,"updatedAt":1918},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1914,1915,1916,1917],{"name":20,"slug":21,"type":15},{"name":1865,"slug":1866,"type":15},{"name":23,"slug":24,"type":15},{"name":1800,"slug":1801,"type":15},"2026-07-12T07:56:47.082609",{"slug":1748,"name":1748,"fn":1749,"description":1750,"org":1920,"tags":1921,"stars":25,"repoUrl":26,"updatedAt":1760},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1922,1923,1924],{"name":20,"slug":21,"type":15},{"name":1755,"slug":1756,"type":15},{"name":1758,"slug":1759,"type":15},{"slug":1762,"name":1762,"fn":1763,"description":1764,"org":1926,"tags":1927,"stars":25,"repoUrl":26,"updatedAt":1775},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1928,1929,1930,1931],{"name":1768,"slug":1769,"type":15},{"name":20,"slug":21,"type":15},{"name":1758,"slug":1759,"type":15},{"name":1773,"slug":1774,"type":15},{"slug":1777,"name":1777,"fn":1778,"description":1779,"org":1933,"tags":1934,"stars":25,"repoUrl":26,"updatedAt":1790},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1935,1936,1937,1938],{"name":1783,"slug":1784,"type":15},{"name":1786,"slug":1787,"type":15},{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},{"slug":1792,"name":1792,"fn":1793,"description":1794,"org":1940,"tags":1941,"stars":25,"repoUrl":26,"updatedAt":1803},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1942,1943,1944,1945],{"name":1783,"slug":1784,"type":15},{"name":20,"slug":21,"type":15},{"name":1800,"slug":1801,"type":15},{"name":13,"slug":14,"type":15},{"slug":1805,"name":1805,"fn":1806,"description":1807,"org":1947,"tags":1948,"stars":25,"repoUrl":26,"updatedAt":1816},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1949,1950,1951,1952],{"name":1783,"slug":1784,"type":15},{"name":1812,"slug":1813,"type":15},{"name":20,"slug":21,"type":15},{"name":1758,"slug":1759,"type":15},{"slug":1818,"name":1818,"fn":1819,"description":1820,"org":1954,"tags":1955,"stars":25,"repoUrl":26,"updatedAt":1829},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1956,1957,1958,1959],{"name":20,"slug":21,"type":15},{"name":1825,"slug":1826,"type":15},{"name":1758,"slug":1759,"type":15},{"name":1773,"slug":1774,"type":15},40]