[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-managing-tls-certificates":3,"mdc-9cbqt-key":39,"related-org-cockroachdb-managing-tls-certificates":2527,"related-repo-cockroachdb-managing-tls-certificates":2685},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"managing-tls-certificates","manage TLS certificates for CockroachDB clusters","Manages TLS certificates for CockroachDB clusters including CA certificate configuration, client certificate authentication, certificate rotation, and troubleshooting SSL\u002FTLS connection errors. Use when setting up client certificate auth, resolving SSL connection failures, rotating certificates, or configuring mTLS for CDC changefeeds.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Operations","operations",{"name":20,"slug":21,"type":15},"Encryption","encryption",{"name":23,"slug":24,"type":15},"Database","database",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:57:00.115497",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fmanaging-tls-certificates","---\nname: managing-tls-certificates\ndescription: Manages TLS certificates for CockroachDB clusters including CA certificate configuration, client certificate authentication, certificate rotation, and troubleshooting SSL\u002FTLS connection errors. Use when setting up client certificate auth, resolving SSL connection failures, rotating certificates, or configuring mTLS for CDC changefeeds.\ncompatibility: Requires ccloud CLI for Cloud clusters. Requires admin access and cockroach cert CLI for self-hosted clusters.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Managing TLS Certificates\n\nManages TLS certificates for CockroachDB clusters, covering CA certificate downloads, client certificate authentication setup, certificate rotation, and troubleshooting common SSL\u002FTLS connection errors. Addresses both CockroachDB Cloud (always-on TLS) and self-hosted certificate lifecycle management.\n\n## When to Use This Skill\n\n- Troubleshooting SSL\u002FTLS connection errors from application clients (DBeaver, TypeORM, psql, Go, Python, Java)\n- Setting up client certificate authentication on CockroachDB Cloud\n- Uploading a custom Client CA to a Cloud cluster\n- Rotating or renewing certificates (Cloud or self-hosted)\n- Configuring mTLS for CDC changefeeds to Kafka\n- Downloading or locating the CA certificate for a Cloud cluster\n\n## Prerequisites\n\n**CockroachDB Cloud:**\n- **ccloud CLI** authenticated (`ccloud auth login`)\n- **Cloud Console access** for CA certificate download\n- **Cluster Admin role** for client CA configuration\n\n**Self-hosted:**\n- **cockroach cert** CLI available\n- **Admin access** to cluster nodes\n- **OpenSSL** for certificate inspection and generation\n\n**Verify access:**\n```bash\n# Cloud\nccloud auth whoami\nccloud cluster list\n\n# Self-hosted — check existing certificates\ncockroach cert list --certs-dir=\u003Ccerts-directory>\n```\n\n## Configuration Decisions\n\nBefore proceeding, determine the user's deployment model. Ask which option applies, then follow only the relevant sections below.\n\n**Decision 1 — Deployment model:**\n- **CockroachDB Cloud:** TLS is always on and the cluster CA is managed by Cockroach Labs. Follow Part 1 for CA download, client certificate auth, and Cloud certificate rotation.\n- **Self-hosted:** Full manual certificate lifecycle management (CA, node, and client certificates). Follow Part 2 for certificate creation, rotation, and management.\n\nParts 3 (Troubleshooting) and 4 (mTLS for CDC) apply to both deployment models.\n\n## Steps\n\n### Part 1: CockroachDB Cloud TLS\n\n> Follow this part if the user selected **CockroachDB Cloud** in Decision 1.\n\nCockroachDB Cloud enforces TLS on all connections. The cluster CA certificate is managed by Cockroach Labs.\n\n#### 1.1 Download the CA Certificate\n\nThe CA certificate is required by clients to verify the cluster's identity.\n\n```bash\n# Download via ccloud CLI\nccloud cluster cert \u003Ccluster-id>\n\n# Or download from the Cloud Console:\n# Cluster > Connect > Download CA Cert\n```\n\nThe CA certificate is also available at: `https:\u002F\u002Fcockroachlabs.cloud\u002Fclusters\u002F\u003Ccluster-id>\u002Fcert`\n\n**Common CA cert locations after download:**\n- macOS: `~\u002F.postgresql\u002Froot.crt`\n- Linux: `~\u002F.postgresql\u002Froot.crt` or `\u002Fetc\u002Fcockroach-certs\u002Fca.crt`\n- Windows: `%APPDATA%\\postgresql\\root.crt`\n\n#### 1.2 Configure Client Certificate Authentication\n\nClient certificate auth provides mutual TLS (mTLS) — the client proves its identity via certificate instead of a password.\n\n**Step 1: Upload a Client CA to the cluster**\n\nThe Client CA signs your client certificates. This is separate from the cluster's CA.\n\n```bash\n# Upload a Client CA certificate via ccloud CLI\nccloud cluster cert set-client-ca \u003Ccluster-id> --cert-file \u003Cclient-ca.crt>\n```\n\n**Step 2: Create a client certificate signed by your Client CA**\n\n```bash\n# Generate a client key and certificate signing request\nopenssl genrsa -out client.\u003Cusername>.key 2048\nopenssl req -new -key client.\u003Cusername>.key \\\n  -out client.\u003Cusername>.csr \\\n  -subj \"\u002FCN=\u003Cusername>\"\n\n# Sign the CSR with your Client CA\nopenssl x509 -req -in client.\u003Cusername>.csr \\\n  -CA client-ca.crt -CAkey client-ca.key \\\n  -CAcreateserial \\\n  -out client.\u003Cusername>.crt \\\n  -days 365\n```\n\n**Step 3: Connect using the client certificate**\n\n```bash\ncockroach sql \\\n  --url \"postgresql:\u002F\u002F\u003Cusername>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full&sslrootcert=\u003Cca.crt>&sslcert=client.\u003Cusername>.crt&sslkey=client.\u003Cusername>.key\"\n```\n\nSee [connection examples reference](references\u002Fconnection-examples.md) for client-specific connection strings.\n\n#### 1.3 Certificate Rotation (Cloud)\n\nClient certificates should be rotated before expiry. The cluster CA certificate is managed by Cockroach Labs and rotated automatically.\n\n**Client certificate rotation:**\n1. Generate a new client certificate signed by the same Client CA (or a new Client CA)\n2. Deploy the new certificate to application clients\n3. Verify connections work with the new certificate\n4. Remove the old certificate from application clients\n\n**Client CA rotation:**\n1. Generate a new Client CA\n2. Upload the new Client CA to the cluster (supports multiple CAs during transition)\n3. Issue new client certificates signed by the new CA\n4. Deploy new client certificates to all applications\n5. Remove the old Client CA after all clients have migrated\n\n### Part 2: Self-Hosted Certificate Management\n\n> Follow this part if the user selected **Self-hosted** in Decision 1.\n\nSelf-hosted CockroachDB requires manual certificate lifecycle management for the CA, node, and client certificates.\n\n#### 2.1 Initialize the Certificate Authority\n\n```bash\n# Create the CA certificate and key\ncockroach cert create-ca \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n```\n\n#### 2.2 Create Node Certificates\n\n```bash\n# Create a node certificate for each node\ncockroach cert create-node \\\n  \u003Cnode-hostname> \\\n  \u003Cnode-ip> \\\n  localhost \\\n  127.0.0.1 \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n```\n\n#### 2.3 Create Client Certificates\n\n```bash\n# Create a client certificate for root user\ncockroach cert create-client root \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n\n# Create a client certificate for an application user\ncockroach cert create-client \u003Cusername> \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n```\n\n#### 2.4 Certificate Rotation (Self-Hosted)\n\n```bash\n# Check certificate expiry\ncockroach cert list --certs-dir=certs\n\n# Or with OpenSSL\nopenssl x509 -in certs\u002Fnode.crt -noout -enddate\n```\n\n**Rotation process:**\n1. Generate new certificates using the existing CA (or rotate the CA first)\n2. Copy new certificates to each node\n3. Reload certificates (SIGHUP — no downtime required):\n   ```bash\n   kill -SIGHUP $(pgrep cockroach)\n   ```\n4. Verify nodes are serving the new certificates\n\n### Part 3: Troubleshooting SSL\u002FTLS Errors\n\nSee [troubleshooting reference](references\u002Ftroubleshooting.md) for a comprehensive error guide.\n\n#### Common Errors and Quick Fixes\n\n**\"x509: certificate signed by unknown authority\"**\n- Client does not trust the cluster's CA certificate\n- Fix: Download the correct CA certificate and set `sslrootcert` in the connection string\n\n**\"SSL SYSCALL error: EOF detected\"**\n- Connection terminated unexpectedly during TLS handshake\n- Fix: Check network connectivity, firewall rules, and that the correct port (26257) is used\n\n**\"tls: bad certificate\"**\n- Client certificate rejected by the server\n- Fix: Verify the client certificate is signed by a CA the cluster trusts (Client CA must be uploaded)\n\n**\"certificate has expired\"**\n- Client or server certificate has passed its expiry date\n- Fix: Rotate the expired certificate (see rotation steps above)\n\n#### Diagnostic Commands\n\n```bash\n# Inspect a certificate\nopenssl x509 -in cert.crt -text -noout\n\n# Verify certificate chain\nopenssl verify -CAfile ca.crt client.crt\n\n# Test TLS connection to cluster\nopenssl s_client -connect \u003Chost>:26257 -CAfile ca.crt\n\n# Check certificate expiry date\nopenssl x509 -in cert.crt -noout -enddate\n```\n\n### Part 4: mTLS for CDC Changefeeds to Kafka\n\nCockroachDB CDC changefeeds can use mTLS to authenticate to Kafka brokers.\n\n```sql\n-- Create a changefeed with mTLS authentication to Kafka\nCREATE CHANGEFEED FOR TABLE orders\n  INTO 'kafka:\u002F\u002F\u003Ckafka-broker>:9093?tls_enabled=true&ca_cert=\u003Cbase64-ca>&client_cert=\u003Cbase64-cert>&client_key=\u003Cbase64-key>'\n  WITH updated, resolved;\n```\n\n**Preparing certificates for changefeed URI:**\n```bash\n# Base64 encode certificates for use in changefeed URI\ncat ca.crt | base64 -w 0    # Linux\ncat ca.crt | base64          # macOS\n\ncat client.crt | base64 -w 0\ncat client.key | base64 -w 0\n```\n\n## Safety Considerations\n\n| Impact Type | Severity | Recommendation |\n|-------------|----------|----------------|\n| Client CA upload | Low | Does not affect existing connections; only adds a new trust root |\n| Client CA removal | High | Invalidates all client certificates signed by that CA |\n| Certificate expiry | High | Monitor expiry dates; rotate before expiration |\n| Wrong CA certificate | Medium | Clients will fail to connect; correctable by updating the CA cert |\n\n**Do not:**\n- Delete the CA private key — it is required for signing new certificates\n- Upload an expired CA certificate\n- Remove a Client CA while clients still depend on it\n- Disable TLS on production clusters (CockroachDB Cloud does not allow this)\n\n## Rollback\n\n**Cloud — Client CA issues:**\n1. If a new Client CA was uploaded incorrectly, upload the correct CA\n2. If client certificates are rejected, revert to password authentication temporarily\n3. Contact CockroachDB support if the cluster CA needs intervention\n\n**Self-hosted — Certificate issues:**\n1. Restore previous certificates from backup\n2. Reload certificates: `kill -SIGHUP $(pgrep cockroach)`\n3. If CA was rotated, ensure all nodes and clients have the new CA\n\n## References\n\n**Skill references:**\n- [Client connection examples](references\u002Fconnection-examples.md) — Connection strings for common clients\n- [TLS troubleshooting guide](references\u002Ftroubleshooting.md) — Common SSL\u002FTLS errors and fixes\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Run a full security posture audit\n- [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) — SSO as an alternative to certificate-based auth\n\n**Official CockroachDB Documentation:**\n- [Transport Layer Security (TLS)](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Ftransport-layer-security.html)\n- [Authentication](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fauthentication.html)\n- [Client Connection Parameters](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fconnection-parameters.html)\n- [cockroach cert Commands](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcockroach-cert.html)\n- [Rotate Security Certificates](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frotate-certificates.html)\n- [Cloud Certificate Management](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fauthentication.html)\n- [CDC Kafka Sink](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fchangefeed-sinks.html#kafka)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Requires ccloud CLI for Cloud clusters. Requires admin access and cockroach cert CLI for self-hosted clusters.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,55,61,68,103,109,118,160,168,201,209,328,334,339,347,368,373,379,386,402,407,414,419,492,503,511,554,560,565,573,578,653,661,998,1006,1050,1064,1070,1075,1083,1107,1115,1143,1149,1162,1167,1173,1228,1234,1360,1366,1492,1498,1578,1586,1650,1656,1668,1674,1682,1703,1711,1724,1732,1745,1753,1766,1772,1964,1970,1975,2016,2024,2164,2170,2274,2282,2305,2311,2319,2337,2345,2369,2375,2383,2406,2414,2439,2447,2521],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Managing TLS Certificates",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Manages TLS certificates for CockroachDB clusters, covering CA certificate downloads, client certificate authentication setup, certificate rotation, and troubleshooting common SSL\u002FTLS connection errors. Addresses both CockroachDB Cloud (always-on TLS) and self-hosted certificate lifecycle management.",{"type":48,"tag":62,"props":63,"children":65},"h2",{"id":64},"when-to-use-this-skill",[66],{"type":53,"value":67},"When to Use This Skill",{"type":48,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88,93,98],{"type":48,"tag":73,"props":74,"children":75},"li",{},[76],{"type":53,"value":77},"Troubleshooting SSL\u002FTLS connection errors from application clients (DBeaver, TypeORM, psql, Go, Python, Java)",{"type":48,"tag":73,"props":79,"children":80},{},[81],{"type":53,"value":82},"Setting up client certificate authentication on CockroachDB Cloud",{"type":48,"tag":73,"props":84,"children":85},{},[86],{"type":53,"value":87},"Uploading a custom Client CA to a Cloud cluster",{"type":48,"tag":73,"props":89,"children":90},{},[91],{"type":53,"value":92},"Rotating or renewing certificates (Cloud or self-hosted)",{"type":48,"tag":73,"props":94,"children":95},{},[96],{"type":53,"value":97},"Configuring mTLS for CDC changefeeds to Kafka",{"type":48,"tag":73,"props":99,"children":100},{},[101],{"type":53,"value":102},"Downloading or locating the CA certificate for a Cloud cluster",{"type":48,"tag":62,"props":104,"children":106},{"id":105},"prerequisites",[107],{"type":53,"value":108},"Prerequisites",{"type":48,"tag":56,"props":110,"children":111},{},[112],{"type":48,"tag":113,"props":114,"children":115},"strong",{},[116],{"type":53,"value":117},"CockroachDB Cloud:",{"type":48,"tag":69,"props":119,"children":120},{},[121,140,150],{"type":48,"tag":73,"props":122,"children":123},{},[124,129,131,138],{"type":48,"tag":113,"props":125,"children":126},{},[127],{"type":53,"value":128},"ccloud CLI",{"type":53,"value":130}," authenticated (",{"type":48,"tag":132,"props":133,"children":135},"code",{"className":134},[],[136],{"type":53,"value":137},"ccloud auth login",{"type":53,"value":139},")",{"type":48,"tag":73,"props":141,"children":142},{},[143,148],{"type":48,"tag":113,"props":144,"children":145},{},[146],{"type":53,"value":147},"Cloud Console access",{"type":53,"value":149}," for CA certificate download",{"type":48,"tag":73,"props":151,"children":152},{},[153,158],{"type":48,"tag":113,"props":154,"children":155},{},[156],{"type":53,"value":157},"Cluster Admin role",{"type":53,"value":159}," for client CA configuration",{"type":48,"tag":56,"props":161,"children":162},{},[163],{"type":48,"tag":113,"props":164,"children":165},{},[166],{"type":53,"value":167},"Self-hosted:",{"type":48,"tag":69,"props":169,"children":170},{},[171,181,191],{"type":48,"tag":73,"props":172,"children":173},{},[174,179],{"type":48,"tag":113,"props":175,"children":176},{},[177],{"type":53,"value":178},"cockroach cert",{"type":53,"value":180}," CLI available",{"type":48,"tag":73,"props":182,"children":183},{},[184,189],{"type":48,"tag":113,"props":185,"children":186},{},[187],{"type":53,"value":188},"Admin access",{"type":53,"value":190}," to cluster nodes",{"type":48,"tag":73,"props":192,"children":193},{},[194,199],{"type":48,"tag":113,"props":195,"children":196},{},[197],{"type":53,"value":198},"OpenSSL",{"type":53,"value":200}," for certificate inspection and generation",{"type":48,"tag":56,"props":202,"children":203},{},[204],{"type":48,"tag":113,"props":205,"children":206},{},[207],{"type":53,"value":208},"Verify access:",{"type":48,"tag":210,"props":211,"children":216},"pre",{"className":212,"code":213,"language":214,"meta":215,"style":215},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Cloud\nccloud auth whoami\nccloud cluster list\n\n# Self-hosted — check existing certificates\ncockroach cert list --certs-dir=\u003Ccerts-directory>\n","bash","",[217],{"type":48,"tag":132,"props":218,"children":219},{"__ignoreMap":215},[220,232,252,269,279,288],{"type":48,"tag":221,"props":222,"children":225},"span",{"class":223,"line":224},"line",1,[226],{"type":48,"tag":221,"props":227,"children":229},{"style":228},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[230],{"type":53,"value":231},"# Cloud\n",{"type":48,"tag":221,"props":233,"children":234},{"class":223,"line":29},[235,241,247],{"type":48,"tag":221,"props":236,"children":238},{"style":237},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[239],{"type":53,"value":240},"ccloud",{"type":48,"tag":221,"props":242,"children":244},{"style":243},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[245],{"type":53,"value":246}," auth",{"type":48,"tag":221,"props":248,"children":249},{"style":243},[250],{"type":53,"value":251}," whoami\n",{"type":48,"tag":221,"props":253,"children":254},{"class":223,"line":25},[255,259,264],{"type":48,"tag":221,"props":256,"children":257},{"style":237},[258],{"type":53,"value":240},{"type":48,"tag":221,"props":260,"children":261},{"style":243},[262],{"type":53,"value":263}," cluster",{"type":48,"tag":221,"props":265,"children":266},{"style":243},[267],{"type":53,"value":268}," list\n",{"type":48,"tag":221,"props":270,"children":272},{"class":223,"line":271},4,[273],{"type":48,"tag":221,"props":274,"children":276},{"emptyLinePlaceholder":275},true,[277],{"type":53,"value":278},"\n",{"type":48,"tag":221,"props":280,"children":282},{"class":223,"line":281},5,[283],{"type":48,"tag":221,"props":284,"children":285},{"style":228},[286],{"type":53,"value":287},"# Self-hosted — check existing certificates\n",{"type":48,"tag":221,"props":289,"children":291},{"class":223,"line":290},6,[292,297,302,307,312,318,323],{"type":48,"tag":221,"props":293,"children":294},{"style":237},[295],{"type":53,"value":296},"cockroach",{"type":48,"tag":221,"props":298,"children":299},{"style":243},[300],{"type":53,"value":301}," cert",{"type":48,"tag":221,"props":303,"children":304},{"style":243},[305],{"type":53,"value":306}," list",{"type":48,"tag":221,"props":308,"children":309},{"style":243},[310],{"type":53,"value":311}," --certs-dir=",{"type":48,"tag":221,"props":313,"children":315},{"style":314},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[316],{"type":53,"value":317},"\u003C",{"type":48,"tag":221,"props":319,"children":320},{"style":243},[321],{"type":53,"value":322},"certs-directory",{"type":48,"tag":221,"props":324,"children":325},{"style":314},[326],{"type":53,"value":327},">\n",{"type":48,"tag":62,"props":329,"children":331},{"id":330},"configuration-decisions",[332],{"type":53,"value":333},"Configuration Decisions",{"type":48,"tag":56,"props":335,"children":336},{},[337],{"type":53,"value":338},"Before proceeding, determine the user's deployment model. Ask which option applies, then follow only the relevant sections below.",{"type":48,"tag":56,"props":340,"children":341},{},[342],{"type":48,"tag":113,"props":343,"children":344},{},[345],{"type":53,"value":346},"Decision 1 — Deployment model:",{"type":48,"tag":69,"props":348,"children":349},{},[350,359],{"type":48,"tag":73,"props":351,"children":352},{},[353,357],{"type":48,"tag":113,"props":354,"children":355},{},[356],{"type":53,"value":117},{"type":53,"value":358}," TLS is always on and the cluster CA is managed by Cockroach Labs. Follow Part 1 for CA download, client certificate auth, and Cloud certificate rotation.",{"type":48,"tag":73,"props":360,"children":361},{},[362,366],{"type":48,"tag":113,"props":363,"children":364},{},[365],{"type":53,"value":167},{"type":53,"value":367}," Full manual certificate lifecycle management (CA, node, and client certificates). Follow Part 2 for certificate creation, rotation, and management.",{"type":48,"tag":56,"props":369,"children":370},{},[371],{"type":53,"value":372},"Parts 3 (Troubleshooting) and 4 (mTLS for CDC) apply to both deployment models.",{"type":48,"tag":62,"props":374,"children":376},{"id":375},"steps",[377],{"type":53,"value":378},"Steps",{"type":48,"tag":380,"props":381,"children":383},"h3",{"id":382},"part-1-cockroachdb-cloud-tls",[384],{"type":53,"value":385},"Part 1: CockroachDB Cloud TLS",{"type":48,"tag":387,"props":388,"children":389},"blockquote",{},[390],{"type":48,"tag":56,"props":391,"children":392},{},[393,395,400],{"type":53,"value":394},"Follow this part if the user selected ",{"type":48,"tag":113,"props":396,"children":397},{},[398],{"type":53,"value":399},"CockroachDB Cloud",{"type":53,"value":401}," in Decision 1.",{"type":48,"tag":56,"props":403,"children":404},{},[405],{"type":53,"value":406},"CockroachDB Cloud enforces TLS on all connections. The cluster CA certificate is managed by Cockroach Labs.",{"type":48,"tag":408,"props":409,"children":411},"h4",{"id":410},"_11-download-the-ca-certificate",[412],{"type":53,"value":413},"1.1 Download the CA Certificate",{"type":48,"tag":56,"props":415,"children":416},{},[417],{"type":53,"value":418},"The CA certificate is required by clients to verify the cluster's identity.",{"type":48,"tag":210,"props":420,"children":422},{"className":212,"code":421,"language":214,"meta":215,"style":215},"# Download via ccloud CLI\nccloud cluster cert \u003Ccluster-id>\n\n# Or download from the Cloud Console:\n# Cluster > Connect > Download CA Cert\n",[423],{"type":48,"tag":132,"props":424,"children":425},{"__ignoreMap":215},[426,434,469,476,484],{"type":48,"tag":221,"props":427,"children":428},{"class":223,"line":224},[429],{"type":48,"tag":221,"props":430,"children":431},{"style":228},[432],{"type":53,"value":433},"# Download via ccloud CLI\n",{"type":48,"tag":221,"props":435,"children":436},{"class":223,"line":29},[437,441,445,449,454,459,465],{"type":48,"tag":221,"props":438,"children":439},{"style":237},[440],{"type":53,"value":240},{"type":48,"tag":221,"props":442,"children":443},{"style":243},[444],{"type":53,"value":263},{"type":48,"tag":221,"props":446,"children":447},{"style":243},[448],{"type":53,"value":301},{"type":48,"tag":221,"props":450,"children":451},{"style":314},[452],{"type":53,"value":453}," \u003C",{"type":48,"tag":221,"props":455,"children":456},{"style":243},[457],{"type":53,"value":458},"cluster-i",{"type":48,"tag":221,"props":460,"children":462},{"style":461},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[463],{"type":53,"value":464},"d",{"type":48,"tag":221,"props":466,"children":467},{"style":314},[468],{"type":53,"value":327},{"type":48,"tag":221,"props":470,"children":471},{"class":223,"line":25},[472],{"type":48,"tag":221,"props":473,"children":474},{"emptyLinePlaceholder":275},[475],{"type":53,"value":278},{"type":48,"tag":221,"props":477,"children":478},{"class":223,"line":271},[479],{"type":48,"tag":221,"props":480,"children":481},{"style":228},[482],{"type":53,"value":483},"# Or download from the Cloud Console:\n",{"type":48,"tag":221,"props":485,"children":486},{"class":223,"line":281},[487],{"type":48,"tag":221,"props":488,"children":489},{"style":228},[490],{"type":53,"value":491},"# Cluster > Connect > Download CA Cert\n",{"type":48,"tag":56,"props":493,"children":494},{},[495,497],{"type":53,"value":496},"The CA certificate is also available at: ",{"type":48,"tag":132,"props":498,"children":500},{"className":499},[],[501],{"type":53,"value":502},"https:\u002F\u002Fcockroachlabs.cloud\u002Fclusters\u002F\u003Ccluster-id>\u002Fcert",{"type":48,"tag":56,"props":504,"children":505},{},[506],{"type":48,"tag":113,"props":507,"children":508},{},[509],{"type":53,"value":510},"Common CA cert locations after download:",{"type":48,"tag":69,"props":512,"children":513},{},[514,525,543],{"type":48,"tag":73,"props":515,"children":516},{},[517,519],{"type":53,"value":518},"macOS: ",{"type":48,"tag":132,"props":520,"children":522},{"className":521},[],[523],{"type":53,"value":524},"~\u002F.postgresql\u002Froot.crt",{"type":48,"tag":73,"props":526,"children":527},{},[528,530,535,537],{"type":53,"value":529},"Linux: ",{"type":48,"tag":132,"props":531,"children":533},{"className":532},[],[534],{"type":53,"value":524},{"type":53,"value":536}," or ",{"type":48,"tag":132,"props":538,"children":540},{"className":539},[],[541],{"type":53,"value":542},"\u002Fetc\u002Fcockroach-certs\u002Fca.crt",{"type":48,"tag":73,"props":544,"children":545},{},[546,548],{"type":53,"value":547},"Windows: ",{"type":48,"tag":132,"props":549,"children":551},{"className":550},[],[552],{"type":53,"value":553},"%APPDATA%\\postgresql\\root.crt",{"type":48,"tag":408,"props":555,"children":557},{"id":556},"_12-configure-client-certificate-authentication",[558],{"type":53,"value":559},"1.2 Configure Client Certificate Authentication",{"type":48,"tag":56,"props":561,"children":562},{},[563],{"type":53,"value":564},"Client certificate auth provides mutual TLS (mTLS) — the client proves its identity via certificate instead of a password.",{"type":48,"tag":56,"props":566,"children":567},{},[568],{"type":48,"tag":113,"props":569,"children":570},{},[571],{"type":53,"value":572},"Step 1: Upload a Client CA to the cluster",{"type":48,"tag":56,"props":574,"children":575},{},[576],{"type":53,"value":577},"The Client CA signs your client certificates. This is separate from the cluster's CA.",{"type":48,"tag":210,"props":579,"children":581},{"className":212,"code":580,"language":214,"meta":215,"style":215},"# Upload a Client CA certificate via ccloud CLI\nccloud cluster cert set-client-ca \u003Ccluster-id> --cert-file \u003Cclient-ca.crt>\n",[582],{"type":48,"tag":132,"props":583,"children":584},{"__ignoreMap":215},[585,593],{"type":48,"tag":221,"props":586,"children":587},{"class":223,"line":224},[588],{"type":48,"tag":221,"props":589,"children":590},{"style":228},[591],{"type":53,"value":592},"# Upload a Client CA certificate via ccloud CLI\n",{"type":48,"tag":221,"props":594,"children":595},{"class":223,"line":29},[596,600,604,608,613,617,621,625,630,635,639,644,649],{"type":48,"tag":221,"props":597,"children":598},{"style":237},[599],{"type":53,"value":240},{"type":48,"tag":221,"props":601,"children":602},{"style":243},[603],{"type":53,"value":263},{"type":48,"tag":221,"props":605,"children":606},{"style":243},[607],{"type":53,"value":301},{"type":48,"tag":221,"props":609,"children":610},{"style":243},[611],{"type":53,"value":612}," set-client-ca",{"type":48,"tag":221,"props":614,"children":615},{"style":314},[616],{"type":53,"value":453},{"type":48,"tag":221,"props":618,"children":619},{"style":243},[620],{"type":53,"value":458},{"type":48,"tag":221,"props":622,"children":623},{"style":461},[624],{"type":53,"value":464},{"type":48,"tag":221,"props":626,"children":627},{"style":314},[628],{"type":53,"value":629},">",{"type":48,"tag":221,"props":631,"children":632},{"style":243},[633],{"type":53,"value":634}," --cert-file",{"type":48,"tag":221,"props":636,"children":637},{"style":314},[638],{"type":53,"value":453},{"type":48,"tag":221,"props":640,"children":641},{"style":243},[642],{"type":53,"value":643},"client-ca.cr",{"type":48,"tag":221,"props":645,"children":646},{"style":461},[647],{"type":53,"value":648},"t",{"type":48,"tag":221,"props":650,"children":651},{"style":314},[652],{"type":53,"value":327},{"type":48,"tag":56,"props":654,"children":655},{},[656],{"type":48,"tag":113,"props":657,"children":658},{},[659],{"type":53,"value":660},"Step 2: Create a client certificate signed by your Client CA",{"type":48,"tag":210,"props":662,"children":664},{"className":212,"code":663,"language":214,"meta":215,"style":215},"# Generate a client key and certificate signing request\nopenssl genrsa -out client.\u003Cusername>.key 2048\nopenssl req -new -key client.\u003Cusername>.key \\\n  -out client.\u003Cusername>.csr \\\n  -subj \"\u002FCN=\u003Cusername>\"\n\n# Sign the CSR with your Client CA\nopenssl x509 -req -in client.\u003Cusername>.csr \\\n  -CA client-ca.crt -CAkey client-ca.key \\\n  -CAcreateserial \\\n  -out client.\u003Cusername>.crt \\\n  -days 365\n",[665],{"type":48,"tag":132,"props":666,"children":667},{"__ignoreMap":215},[668,676,728,779,816,839,846,855,906,934,947,984],{"type":48,"tag":221,"props":669,"children":670},{"class":223,"line":224},[671],{"type":48,"tag":221,"props":672,"children":673},{"style":228},[674],{"type":53,"value":675},"# Generate a client key and certificate signing request\n",{"type":48,"tag":221,"props":677,"children":678},{"class":223,"line":29},[679,684,689,694,699,703,708,713,717,722],{"type":48,"tag":221,"props":680,"children":681},{"style":237},[682],{"type":53,"value":683},"openssl",{"type":48,"tag":221,"props":685,"children":686},{"style":243},[687],{"type":53,"value":688}," genrsa",{"type":48,"tag":221,"props":690,"children":691},{"style":243},[692],{"type":53,"value":693}," -out",{"type":48,"tag":221,"props":695,"children":696},{"style":243},[697],{"type":53,"value":698}," client.",{"type":48,"tag":221,"props":700,"children":701},{"style":314},[702],{"type":53,"value":317},{"type":48,"tag":221,"props":704,"children":705},{"style":243},[706],{"type":53,"value":707},"usernam",{"type":48,"tag":221,"props":709,"children":710},{"style":461},[711],{"type":53,"value":712},"e",{"type":48,"tag":221,"props":714,"children":715},{"style":314},[716],{"type":53,"value":629},{"type":48,"tag":221,"props":718,"children":719},{"style":243},[720],{"type":53,"value":721},".key",{"type":48,"tag":221,"props":723,"children":725},{"style":724},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[726],{"type":53,"value":727}," 2048\n",{"type":48,"tag":221,"props":729,"children":730},{"class":223,"line":25},[731,735,740,745,750,754,758,762,766,770,774],{"type":48,"tag":221,"props":732,"children":733},{"style":237},[734],{"type":53,"value":683},{"type":48,"tag":221,"props":736,"children":737},{"style":243},[738],{"type":53,"value":739}," req",{"type":48,"tag":221,"props":741,"children":742},{"style":243},[743],{"type":53,"value":744}," -new",{"type":48,"tag":221,"props":746,"children":747},{"style":243},[748],{"type":53,"value":749}," -key",{"type":48,"tag":221,"props":751,"children":752},{"style":243},[753],{"type":53,"value":698},{"type":48,"tag":221,"props":755,"children":756},{"style":314},[757],{"type":53,"value":317},{"type":48,"tag":221,"props":759,"children":760},{"style":243},[761],{"type":53,"value":707},{"type":48,"tag":221,"props":763,"children":764},{"style":461},[765],{"type":53,"value":712},{"type":48,"tag":221,"props":767,"children":768},{"style":314},[769],{"type":53,"value":629},{"type":48,"tag":221,"props":771,"children":772},{"style":243},[773],{"type":53,"value":721},{"type":48,"tag":221,"props":775,"children":776},{"style":461},[777],{"type":53,"value":778}," \\\n",{"type":48,"tag":221,"props":780,"children":781},{"class":223,"line":271},[782,787,791,795,799,803,807,812],{"type":48,"tag":221,"props":783,"children":784},{"style":243},[785],{"type":53,"value":786},"  -out",{"type":48,"tag":221,"props":788,"children":789},{"style":243},[790],{"type":53,"value":698},{"type":48,"tag":221,"props":792,"children":793},{"style":314},[794],{"type":53,"value":317},{"type":48,"tag":221,"props":796,"children":797},{"style":243},[798],{"type":53,"value":707},{"type":48,"tag":221,"props":800,"children":801},{"style":461},[802],{"type":53,"value":712},{"type":48,"tag":221,"props":804,"children":805},{"style":314},[806],{"type":53,"value":629},{"type":48,"tag":221,"props":808,"children":809},{"style":243},[810],{"type":53,"value":811},".csr",{"type":48,"tag":221,"props":813,"children":814},{"style":461},[815],{"type":53,"value":778},{"type":48,"tag":221,"props":817,"children":818},{"class":223,"line":281},[819,824,829,834],{"type":48,"tag":221,"props":820,"children":821},{"style":243},[822],{"type":53,"value":823},"  -subj",{"type":48,"tag":221,"props":825,"children":826},{"style":314},[827],{"type":53,"value":828}," \"",{"type":48,"tag":221,"props":830,"children":831},{"style":243},[832],{"type":53,"value":833},"\u002FCN=\u003Cusername>",{"type":48,"tag":221,"props":835,"children":836},{"style":314},[837],{"type":53,"value":838},"\"\n",{"type":48,"tag":221,"props":840,"children":841},{"class":223,"line":290},[842],{"type":48,"tag":221,"props":843,"children":844},{"emptyLinePlaceholder":275},[845],{"type":53,"value":278},{"type":48,"tag":221,"props":847,"children":849},{"class":223,"line":848},7,[850],{"type":48,"tag":221,"props":851,"children":852},{"style":228},[853],{"type":53,"value":854},"# Sign the CSR with your Client CA\n",{"type":48,"tag":221,"props":856,"children":858},{"class":223,"line":857},8,[859,863,868,873,878,882,886,890,894,898,902],{"type":48,"tag":221,"props":860,"children":861},{"style":237},[862],{"type":53,"value":683},{"type":48,"tag":221,"props":864,"children":865},{"style":243},[866],{"type":53,"value":867}," x509",{"type":48,"tag":221,"props":869,"children":870},{"style":243},[871],{"type":53,"value":872}," -req",{"type":48,"tag":221,"props":874,"children":875},{"style":243},[876],{"type":53,"value":877}," -in",{"type":48,"tag":221,"props":879,"children":880},{"style":243},[881],{"type":53,"value":698},{"type":48,"tag":221,"props":883,"children":884},{"style":314},[885],{"type":53,"value":317},{"type":48,"tag":221,"props":887,"children":888},{"style":243},[889],{"type":53,"value":707},{"type":48,"tag":221,"props":891,"children":892},{"style":461},[893],{"type":53,"value":712},{"type":48,"tag":221,"props":895,"children":896},{"style":314},[897],{"type":53,"value":629},{"type":48,"tag":221,"props":899,"children":900},{"style":243},[901],{"type":53,"value":811},{"type":48,"tag":221,"props":903,"children":904},{"style":461},[905],{"type":53,"value":778},{"type":48,"tag":221,"props":907,"children":909},{"class":223,"line":908},9,[910,915,920,925,930],{"type":48,"tag":221,"props":911,"children":912},{"style":243},[913],{"type":53,"value":914},"  -CA",{"type":48,"tag":221,"props":916,"children":917},{"style":243},[918],{"type":53,"value":919}," client-ca.crt",{"type":48,"tag":221,"props":921,"children":922},{"style":243},[923],{"type":53,"value":924}," -CAkey",{"type":48,"tag":221,"props":926,"children":927},{"style":243},[928],{"type":53,"value":929}," client-ca.key",{"type":48,"tag":221,"props":931,"children":932},{"style":461},[933],{"type":53,"value":778},{"type":48,"tag":221,"props":935,"children":937},{"class":223,"line":936},10,[938,943],{"type":48,"tag":221,"props":939,"children":940},{"style":243},[941],{"type":53,"value":942},"  -CAcreateserial",{"type":48,"tag":221,"props":944,"children":945},{"style":461},[946],{"type":53,"value":778},{"type":48,"tag":221,"props":948,"children":950},{"class":223,"line":949},11,[951,955,959,963,967,971,975,980],{"type":48,"tag":221,"props":952,"children":953},{"style":243},[954],{"type":53,"value":786},{"type":48,"tag":221,"props":956,"children":957},{"style":243},[958],{"type":53,"value":698},{"type":48,"tag":221,"props":960,"children":961},{"style":314},[962],{"type":53,"value":317},{"type":48,"tag":221,"props":964,"children":965},{"style":243},[966],{"type":53,"value":707},{"type":48,"tag":221,"props":968,"children":969},{"style":461},[970],{"type":53,"value":712},{"type":48,"tag":221,"props":972,"children":973},{"style":314},[974],{"type":53,"value":629},{"type":48,"tag":221,"props":976,"children":977},{"style":243},[978],{"type":53,"value":979},".crt",{"type":48,"tag":221,"props":981,"children":982},{"style":461},[983],{"type":53,"value":778},{"type":48,"tag":221,"props":985,"children":987},{"class":223,"line":986},12,[988,993],{"type":48,"tag":221,"props":989,"children":990},{"style":243},[991],{"type":53,"value":992},"  -days",{"type":48,"tag":221,"props":994,"children":995},{"style":724},[996],{"type":53,"value":997}," 365\n",{"type":48,"tag":56,"props":999,"children":1000},{},[1001],{"type":48,"tag":113,"props":1002,"children":1003},{},[1004],{"type":53,"value":1005},"Step 3: Connect using the client certificate",{"type":48,"tag":210,"props":1007,"children":1009},{"className":212,"code":1008,"language":214,"meta":215,"style":215},"cockroach sql \\\n  --url \"postgresql:\u002F\u002F\u003Cusername>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full&sslrootcert=\u003Cca.crt>&sslcert=client.\u003Cusername>.crt&sslkey=client.\u003Cusername>.key\"\n",[1010],{"type":48,"tag":132,"props":1011,"children":1012},{"__ignoreMap":215},[1013,1029],{"type":48,"tag":221,"props":1014,"children":1015},{"class":223,"line":224},[1016,1020,1025],{"type":48,"tag":221,"props":1017,"children":1018},{"style":237},[1019],{"type":53,"value":296},{"type":48,"tag":221,"props":1021,"children":1022},{"style":243},[1023],{"type":53,"value":1024}," sql",{"type":48,"tag":221,"props":1026,"children":1027},{"style":461},[1028],{"type":53,"value":778},{"type":48,"tag":221,"props":1030,"children":1031},{"class":223,"line":29},[1032,1037,1041,1046],{"type":48,"tag":221,"props":1033,"children":1034},{"style":243},[1035],{"type":53,"value":1036},"  --url",{"type":48,"tag":221,"props":1038,"children":1039},{"style":314},[1040],{"type":53,"value":828},{"type":48,"tag":221,"props":1042,"children":1043},{"style":243},[1044],{"type":53,"value":1045},"postgresql:\u002F\u002F\u003Cusername>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full&sslrootcert=\u003Cca.crt>&sslcert=client.\u003Cusername>.crt&sslkey=client.\u003Cusername>.key",{"type":48,"tag":221,"props":1047,"children":1048},{"style":314},[1049],{"type":53,"value":838},{"type":48,"tag":56,"props":1051,"children":1052},{},[1053,1055,1062],{"type":53,"value":1054},"See ",{"type":48,"tag":1056,"props":1057,"children":1059},"a",{"href":1058},"references\u002Fconnection-examples.md",[1060],{"type":53,"value":1061},"connection examples reference",{"type":53,"value":1063}," for client-specific connection strings.",{"type":48,"tag":408,"props":1065,"children":1067},{"id":1066},"_13-certificate-rotation-cloud",[1068],{"type":53,"value":1069},"1.3 Certificate Rotation (Cloud)",{"type":48,"tag":56,"props":1071,"children":1072},{},[1073],{"type":53,"value":1074},"Client certificates should be rotated before expiry. The cluster CA certificate is managed by Cockroach Labs and rotated automatically.",{"type":48,"tag":56,"props":1076,"children":1077},{},[1078],{"type":48,"tag":113,"props":1079,"children":1080},{},[1081],{"type":53,"value":1082},"Client certificate rotation:",{"type":48,"tag":1084,"props":1085,"children":1086},"ol",{},[1087,1092,1097,1102],{"type":48,"tag":73,"props":1088,"children":1089},{},[1090],{"type":53,"value":1091},"Generate a new client certificate signed by the same Client CA (or a new Client CA)",{"type":48,"tag":73,"props":1093,"children":1094},{},[1095],{"type":53,"value":1096},"Deploy the new certificate to application clients",{"type":48,"tag":73,"props":1098,"children":1099},{},[1100],{"type":53,"value":1101},"Verify connections work with the new certificate",{"type":48,"tag":73,"props":1103,"children":1104},{},[1105],{"type":53,"value":1106},"Remove the old certificate from application clients",{"type":48,"tag":56,"props":1108,"children":1109},{},[1110],{"type":48,"tag":113,"props":1111,"children":1112},{},[1113],{"type":53,"value":1114},"Client CA rotation:",{"type":48,"tag":1084,"props":1116,"children":1117},{},[1118,1123,1128,1133,1138],{"type":48,"tag":73,"props":1119,"children":1120},{},[1121],{"type":53,"value":1122},"Generate a new Client CA",{"type":48,"tag":73,"props":1124,"children":1125},{},[1126],{"type":53,"value":1127},"Upload the new Client CA to the cluster (supports multiple CAs during transition)",{"type":48,"tag":73,"props":1129,"children":1130},{},[1131],{"type":53,"value":1132},"Issue new client certificates signed by the new CA",{"type":48,"tag":73,"props":1134,"children":1135},{},[1136],{"type":53,"value":1137},"Deploy new client certificates to all applications",{"type":48,"tag":73,"props":1139,"children":1140},{},[1141],{"type":53,"value":1142},"Remove the old Client CA after all clients have migrated",{"type":48,"tag":380,"props":1144,"children":1146},{"id":1145},"part-2-self-hosted-certificate-management",[1147],{"type":53,"value":1148},"Part 2: Self-Hosted Certificate Management",{"type":48,"tag":387,"props":1150,"children":1151},{},[1152],{"type":48,"tag":56,"props":1153,"children":1154},{},[1155,1156,1161],{"type":53,"value":394},{"type":48,"tag":113,"props":1157,"children":1158},{},[1159],{"type":53,"value":1160},"Self-hosted",{"type":53,"value":401},{"type":48,"tag":56,"props":1163,"children":1164},{},[1165],{"type":53,"value":1166},"Self-hosted CockroachDB requires manual certificate lifecycle management for the CA, node, and client certificates.",{"type":48,"tag":408,"props":1168,"children":1170},{"id":1169},"_21-initialize-the-certificate-authority",[1171],{"type":53,"value":1172},"2.1 Initialize the Certificate Authority",{"type":48,"tag":210,"props":1174,"children":1176},{"className":212,"code":1175,"language":214,"meta":215,"style":215},"# Create the CA certificate and key\ncockroach cert create-ca \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n",[1177],{"type":48,"tag":132,"props":1178,"children":1179},{"__ignoreMap":215},[1180,1188,1208,1220],{"type":48,"tag":221,"props":1181,"children":1182},{"class":223,"line":224},[1183],{"type":48,"tag":221,"props":1184,"children":1185},{"style":228},[1186],{"type":53,"value":1187},"# Create the CA certificate and key\n",{"type":48,"tag":221,"props":1189,"children":1190},{"class":223,"line":29},[1191,1195,1199,1204],{"type":48,"tag":221,"props":1192,"children":1193},{"style":237},[1194],{"type":53,"value":296},{"type":48,"tag":221,"props":1196,"children":1197},{"style":243},[1198],{"type":53,"value":301},{"type":48,"tag":221,"props":1200,"children":1201},{"style":243},[1202],{"type":53,"value":1203}," create-ca",{"type":48,"tag":221,"props":1205,"children":1206},{"style":461},[1207],{"type":53,"value":778},{"type":48,"tag":221,"props":1209,"children":1210},{"class":223,"line":25},[1211,1216],{"type":48,"tag":221,"props":1212,"children":1213},{"style":243},[1214],{"type":53,"value":1215},"  --certs-dir=certs",{"type":48,"tag":221,"props":1217,"children":1218},{"style":461},[1219],{"type":53,"value":778},{"type":48,"tag":221,"props":1221,"children":1222},{"class":223,"line":271},[1223],{"type":48,"tag":221,"props":1224,"children":1225},{"style":243},[1226],{"type":53,"value":1227},"  --ca-key=my-safe-directory\u002Fca.key\n",{"type":48,"tag":408,"props":1229,"children":1231},{"id":1230},"_22-create-node-certificates",[1232],{"type":53,"value":1233},"2.2 Create Node Certificates",{"type":48,"tag":210,"props":1235,"children":1237},{"className":212,"code":1236,"language":214,"meta":215,"style":215},"# Create a node certificate for each node\ncockroach cert create-node \\\n  \u003Cnode-hostname> \\\n  \u003Cnode-ip> \\\n  localhost \\\n  127.0.0.1 \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n",[1238],{"type":48,"tag":132,"props":1239,"children":1240},{"__ignoreMap":215},[1241,1249,1269,1294,1318,1330,1342,1353],{"type":48,"tag":221,"props":1242,"children":1243},{"class":223,"line":224},[1244],{"type":48,"tag":221,"props":1245,"children":1246},{"style":228},[1247],{"type":53,"value":1248},"# Create a node certificate for each node\n",{"type":48,"tag":221,"props":1250,"children":1251},{"class":223,"line":29},[1252,1256,1260,1265],{"type":48,"tag":221,"props":1253,"children":1254},{"style":237},[1255],{"type":53,"value":296},{"type":48,"tag":221,"props":1257,"children":1258},{"style":243},[1259],{"type":53,"value":301},{"type":48,"tag":221,"props":1261,"children":1262},{"style":243},[1263],{"type":53,"value":1264}," create-node",{"type":48,"tag":221,"props":1266,"children":1267},{"style":461},[1268],{"type":53,"value":778},{"type":48,"tag":221,"props":1270,"children":1271},{"class":223,"line":25},[1272,1277,1282,1286,1290],{"type":48,"tag":221,"props":1273,"children":1274},{"style":314},[1275],{"type":53,"value":1276},"  \u003C",{"type":48,"tag":221,"props":1278,"children":1279},{"style":243},[1280],{"type":53,"value":1281},"node-hostnam",{"type":48,"tag":221,"props":1283,"children":1284},{"style":461},[1285],{"type":53,"value":712},{"type":48,"tag":221,"props":1287,"children":1288},{"style":314},[1289],{"type":53,"value":629},{"type":48,"tag":221,"props":1291,"children":1292},{"style":461},[1293],{"type":53,"value":778},{"type":48,"tag":221,"props":1295,"children":1296},{"class":223,"line":271},[1297,1301,1306,1310,1314],{"type":48,"tag":221,"props":1298,"children":1299},{"style":314},[1300],{"type":53,"value":1276},{"type":48,"tag":221,"props":1302,"children":1303},{"style":243},[1304],{"type":53,"value":1305},"node-i",{"type":48,"tag":221,"props":1307,"children":1308},{"style":461},[1309],{"type":53,"value":56},{"type":48,"tag":221,"props":1311,"children":1312},{"style":314},[1313],{"type":53,"value":629},{"type":48,"tag":221,"props":1315,"children":1316},{"style":461},[1317],{"type":53,"value":778},{"type":48,"tag":221,"props":1319,"children":1320},{"class":223,"line":281},[1321,1326],{"type":48,"tag":221,"props":1322,"children":1323},{"style":243},[1324],{"type":53,"value":1325},"  localhost",{"type":48,"tag":221,"props":1327,"children":1328},{"style":461},[1329],{"type":53,"value":778},{"type":48,"tag":221,"props":1331,"children":1332},{"class":223,"line":290},[1333,1338],{"type":48,"tag":221,"props":1334,"children":1335},{"style":724},[1336],{"type":53,"value":1337},"  127.0.0.1",{"type":48,"tag":221,"props":1339,"children":1340},{"style":461},[1341],{"type":53,"value":778},{"type":48,"tag":221,"props":1343,"children":1344},{"class":223,"line":848},[1345,1349],{"type":48,"tag":221,"props":1346,"children":1347},{"style":243},[1348],{"type":53,"value":1215},{"type":48,"tag":221,"props":1350,"children":1351},{"style":461},[1352],{"type":53,"value":778},{"type":48,"tag":221,"props":1354,"children":1355},{"class":223,"line":857},[1356],{"type":48,"tag":221,"props":1357,"children":1358},{"style":243},[1359],{"type":53,"value":1227},{"type":48,"tag":408,"props":1361,"children":1363},{"id":1362},"_23-create-client-certificates",[1364],{"type":53,"value":1365},"2.3 Create Client Certificates",{"type":48,"tag":210,"props":1367,"children":1369},{"className":212,"code":1368,"language":214,"meta":215,"style":215},"# Create a client certificate for root user\ncockroach cert create-client root \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n\n# Create a client certificate for an application user\ncockroach cert create-client \u003Cusername> \\\n  --certs-dir=certs \\\n  --ca-key=my-safe-directory\u002Fca.key\n",[1370],{"type":48,"tag":132,"props":1371,"children":1372},{"__ignoreMap":215},[1373,1381,1406,1417,1424,1431,1439,1474,1485],{"type":48,"tag":221,"props":1374,"children":1375},{"class":223,"line":224},[1376],{"type":48,"tag":221,"props":1377,"children":1378},{"style":228},[1379],{"type":53,"value":1380},"# Create a client certificate for root user\n",{"type":48,"tag":221,"props":1382,"children":1383},{"class":223,"line":29},[1384,1388,1392,1397,1402],{"type":48,"tag":221,"props":1385,"children":1386},{"style":237},[1387],{"type":53,"value":296},{"type":48,"tag":221,"props":1389,"children":1390},{"style":243},[1391],{"type":53,"value":301},{"type":48,"tag":221,"props":1393,"children":1394},{"style":243},[1395],{"type":53,"value":1396}," create-client",{"type":48,"tag":221,"props":1398,"children":1399},{"style":243},[1400],{"type":53,"value":1401}," root",{"type":48,"tag":221,"props":1403,"children":1404},{"style":461},[1405],{"type":53,"value":778},{"type":48,"tag":221,"props":1407,"children":1408},{"class":223,"line":25},[1409,1413],{"type":48,"tag":221,"props":1410,"children":1411},{"style":243},[1412],{"type":53,"value":1215},{"type":48,"tag":221,"props":1414,"children":1415},{"style":461},[1416],{"type":53,"value":778},{"type":48,"tag":221,"props":1418,"children":1419},{"class":223,"line":271},[1420],{"type":48,"tag":221,"props":1421,"children":1422},{"style":243},[1423],{"type":53,"value":1227},{"type":48,"tag":221,"props":1425,"children":1426},{"class":223,"line":281},[1427],{"type":48,"tag":221,"props":1428,"children":1429},{"emptyLinePlaceholder":275},[1430],{"type":53,"value":278},{"type":48,"tag":221,"props":1432,"children":1433},{"class":223,"line":290},[1434],{"type":48,"tag":221,"props":1435,"children":1436},{"style":228},[1437],{"type":53,"value":1438},"# Create a client certificate for an application user\n",{"type":48,"tag":221,"props":1440,"children":1441},{"class":223,"line":848},[1442,1446,1450,1454,1458,1462,1466,1470],{"type":48,"tag":221,"props":1443,"children":1444},{"style":237},[1445],{"type":53,"value":296},{"type":48,"tag":221,"props":1447,"children":1448},{"style":243},[1449],{"type":53,"value":301},{"type":48,"tag":221,"props":1451,"children":1452},{"style":243},[1453],{"type":53,"value":1396},{"type":48,"tag":221,"props":1455,"children":1456},{"style":314},[1457],{"type":53,"value":453},{"type":48,"tag":221,"props":1459,"children":1460},{"style":243},[1461],{"type":53,"value":707},{"type":48,"tag":221,"props":1463,"children":1464},{"style":461},[1465],{"type":53,"value":712},{"type":48,"tag":221,"props":1467,"children":1468},{"style":314},[1469],{"type":53,"value":629},{"type":48,"tag":221,"props":1471,"children":1472},{"style":461},[1473],{"type":53,"value":778},{"type":48,"tag":221,"props":1475,"children":1476},{"class":223,"line":857},[1477,1481],{"type":48,"tag":221,"props":1478,"children":1479},{"style":243},[1480],{"type":53,"value":1215},{"type":48,"tag":221,"props":1482,"children":1483},{"style":461},[1484],{"type":53,"value":778},{"type":48,"tag":221,"props":1486,"children":1487},{"class":223,"line":908},[1488],{"type":48,"tag":221,"props":1489,"children":1490},{"style":243},[1491],{"type":53,"value":1227},{"type":48,"tag":408,"props":1493,"children":1495},{"id":1494},"_24-certificate-rotation-self-hosted",[1496],{"type":53,"value":1497},"2.4 Certificate Rotation (Self-Hosted)",{"type":48,"tag":210,"props":1499,"children":1501},{"className":212,"code":1500,"language":214,"meta":215,"style":215},"# Check certificate expiry\ncockroach cert list --certs-dir=certs\n\n# Or with OpenSSL\nopenssl x509 -in certs\u002Fnode.crt -noout -enddate\n",[1502],{"type":48,"tag":132,"props":1503,"children":1504},{"__ignoreMap":215},[1505,1513,1533,1540,1548],{"type":48,"tag":221,"props":1506,"children":1507},{"class":223,"line":224},[1508],{"type":48,"tag":221,"props":1509,"children":1510},{"style":228},[1511],{"type":53,"value":1512},"# Check certificate expiry\n",{"type":48,"tag":221,"props":1514,"children":1515},{"class":223,"line":29},[1516,1520,1524,1528],{"type":48,"tag":221,"props":1517,"children":1518},{"style":237},[1519],{"type":53,"value":296},{"type":48,"tag":221,"props":1521,"children":1522},{"style":243},[1523],{"type":53,"value":301},{"type":48,"tag":221,"props":1525,"children":1526},{"style":243},[1527],{"type":53,"value":306},{"type":48,"tag":221,"props":1529,"children":1530},{"style":243},[1531],{"type":53,"value":1532}," --certs-dir=certs\n",{"type":48,"tag":221,"props":1534,"children":1535},{"class":223,"line":25},[1536],{"type":48,"tag":221,"props":1537,"children":1538},{"emptyLinePlaceholder":275},[1539],{"type":53,"value":278},{"type":48,"tag":221,"props":1541,"children":1542},{"class":223,"line":271},[1543],{"type":48,"tag":221,"props":1544,"children":1545},{"style":228},[1546],{"type":53,"value":1547},"# Or with OpenSSL\n",{"type":48,"tag":221,"props":1549,"children":1550},{"class":223,"line":281},[1551,1555,1559,1563,1568,1573],{"type":48,"tag":221,"props":1552,"children":1553},{"style":237},[1554],{"type":53,"value":683},{"type":48,"tag":221,"props":1556,"children":1557},{"style":243},[1558],{"type":53,"value":867},{"type":48,"tag":221,"props":1560,"children":1561},{"style":243},[1562],{"type":53,"value":877},{"type":48,"tag":221,"props":1564,"children":1565},{"style":243},[1566],{"type":53,"value":1567}," certs\u002Fnode.crt",{"type":48,"tag":221,"props":1569,"children":1570},{"style":243},[1571],{"type":53,"value":1572}," -noout",{"type":48,"tag":221,"props":1574,"children":1575},{"style":243},[1576],{"type":53,"value":1577}," -enddate\n",{"type":48,"tag":56,"props":1579,"children":1580},{},[1581],{"type":48,"tag":113,"props":1582,"children":1583},{},[1584],{"type":53,"value":1585},"Rotation process:",{"type":48,"tag":1084,"props":1587,"children":1588},{},[1589,1594,1599,1645],{"type":48,"tag":73,"props":1590,"children":1591},{},[1592],{"type":53,"value":1593},"Generate new certificates using the existing CA (or rotate the CA first)",{"type":48,"tag":73,"props":1595,"children":1596},{},[1597],{"type":53,"value":1598},"Copy new certificates to each node",{"type":48,"tag":73,"props":1600,"children":1601},{},[1602,1604],{"type":53,"value":1603},"Reload certificates (SIGHUP — no downtime required):\n",{"type":48,"tag":210,"props":1605,"children":1607},{"className":212,"code":1606,"language":214,"meta":215,"style":215},"kill -SIGHUP $(pgrep cockroach)\n",[1608],{"type":48,"tag":132,"props":1609,"children":1610},{"__ignoreMap":215},[1611],{"type":48,"tag":221,"props":1612,"children":1613},{"class":223,"line":224},[1614,1620,1625,1630,1635,1640],{"type":48,"tag":221,"props":1615,"children":1617},{"style":1616},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1618],{"type":53,"value":1619},"kill",{"type":48,"tag":221,"props":1621,"children":1622},{"style":243},[1623],{"type":53,"value":1624}," -SIGHUP",{"type":48,"tag":221,"props":1626,"children":1627},{"style":314},[1628],{"type":53,"value":1629}," $(",{"type":48,"tag":221,"props":1631,"children":1632},{"style":237},[1633],{"type":53,"value":1634},"pgrep",{"type":48,"tag":221,"props":1636,"children":1637},{"style":243},[1638],{"type":53,"value":1639}," cockroach",{"type":48,"tag":221,"props":1641,"children":1642},{"style":314},[1643],{"type":53,"value":1644},")\n",{"type":48,"tag":73,"props":1646,"children":1647},{},[1648],{"type":53,"value":1649},"Verify nodes are serving the new certificates",{"type":48,"tag":380,"props":1651,"children":1653},{"id":1652},"part-3-troubleshooting-ssltls-errors",[1654],{"type":53,"value":1655},"Part 3: Troubleshooting SSL\u002FTLS Errors",{"type":48,"tag":56,"props":1657,"children":1658},{},[1659,1660,1666],{"type":53,"value":1054},{"type":48,"tag":1056,"props":1661,"children":1663},{"href":1662},"references\u002Ftroubleshooting.md",[1664],{"type":53,"value":1665},"troubleshooting reference",{"type":53,"value":1667}," for a comprehensive error guide.",{"type":48,"tag":408,"props":1669,"children":1671},{"id":1670},"common-errors-and-quick-fixes",[1672],{"type":53,"value":1673},"Common Errors and Quick Fixes",{"type":48,"tag":56,"props":1675,"children":1676},{},[1677],{"type":48,"tag":113,"props":1678,"children":1679},{},[1680],{"type":53,"value":1681},"\"x509: certificate signed by unknown authority\"",{"type":48,"tag":69,"props":1683,"children":1684},{},[1685,1690],{"type":48,"tag":73,"props":1686,"children":1687},{},[1688],{"type":53,"value":1689},"Client does not trust the cluster's CA certificate",{"type":48,"tag":73,"props":1691,"children":1692},{},[1693,1695,1701],{"type":53,"value":1694},"Fix: Download the correct CA certificate and set ",{"type":48,"tag":132,"props":1696,"children":1698},{"className":1697},[],[1699],{"type":53,"value":1700},"sslrootcert",{"type":53,"value":1702}," in the connection string",{"type":48,"tag":56,"props":1704,"children":1705},{},[1706],{"type":48,"tag":113,"props":1707,"children":1708},{},[1709],{"type":53,"value":1710},"\"SSL SYSCALL error: EOF detected\"",{"type":48,"tag":69,"props":1712,"children":1713},{},[1714,1719],{"type":48,"tag":73,"props":1715,"children":1716},{},[1717],{"type":53,"value":1718},"Connection terminated unexpectedly during TLS handshake",{"type":48,"tag":73,"props":1720,"children":1721},{},[1722],{"type":53,"value":1723},"Fix: Check network connectivity, firewall rules, and that the correct port (26257) is used",{"type":48,"tag":56,"props":1725,"children":1726},{},[1727],{"type":48,"tag":113,"props":1728,"children":1729},{},[1730],{"type":53,"value":1731},"\"tls: bad certificate\"",{"type":48,"tag":69,"props":1733,"children":1734},{},[1735,1740],{"type":48,"tag":73,"props":1736,"children":1737},{},[1738],{"type":53,"value":1739},"Client certificate rejected by the server",{"type":48,"tag":73,"props":1741,"children":1742},{},[1743],{"type":53,"value":1744},"Fix: Verify the client certificate is signed by a CA the cluster trusts (Client CA must be uploaded)",{"type":48,"tag":56,"props":1746,"children":1747},{},[1748],{"type":48,"tag":113,"props":1749,"children":1750},{},[1751],{"type":53,"value":1752},"\"certificate has expired\"",{"type":48,"tag":69,"props":1754,"children":1755},{},[1756,1761],{"type":48,"tag":73,"props":1757,"children":1758},{},[1759],{"type":53,"value":1760},"Client or server certificate has passed its expiry date",{"type":48,"tag":73,"props":1762,"children":1763},{},[1764],{"type":53,"value":1765},"Fix: Rotate the expired certificate (see rotation steps above)",{"type":48,"tag":408,"props":1767,"children":1769},{"id":1768},"diagnostic-commands",[1770],{"type":53,"value":1771},"Diagnostic Commands",{"type":48,"tag":210,"props":1773,"children":1775},{"className":212,"code":1774,"language":214,"meta":215,"style":215},"# Inspect a certificate\nopenssl x509 -in cert.crt -text -noout\n\n# Verify certificate chain\nopenssl verify -CAfile ca.crt client.crt\n\n# Test TLS connection to cluster\nopenssl s_client -connect \u003Chost>:26257 -CAfile ca.crt\n\n# Check certificate expiry date\nopenssl x509 -in cert.crt -noout -enddate\n",[1776],{"type":48,"tag":132,"props":1777,"children":1778},{"__ignoreMap":215},[1779,1787,1817,1824,1832,1859,1866,1874,1922,1929,1937],{"type":48,"tag":221,"props":1780,"children":1781},{"class":223,"line":224},[1782],{"type":48,"tag":221,"props":1783,"children":1784},{"style":228},[1785],{"type":53,"value":1786},"# Inspect a certificate\n",{"type":48,"tag":221,"props":1788,"children":1789},{"class":223,"line":29},[1790,1794,1798,1802,1807,1812],{"type":48,"tag":221,"props":1791,"children":1792},{"style":237},[1793],{"type":53,"value":683},{"type":48,"tag":221,"props":1795,"children":1796},{"style":243},[1797],{"type":53,"value":867},{"type":48,"tag":221,"props":1799,"children":1800},{"style":243},[1801],{"type":53,"value":877},{"type":48,"tag":221,"props":1803,"children":1804},{"style":243},[1805],{"type":53,"value":1806}," cert.crt",{"type":48,"tag":221,"props":1808,"children":1809},{"style":243},[1810],{"type":53,"value":1811}," -text",{"type":48,"tag":221,"props":1813,"children":1814},{"style":243},[1815],{"type":53,"value":1816}," -noout\n",{"type":48,"tag":221,"props":1818,"children":1819},{"class":223,"line":25},[1820],{"type":48,"tag":221,"props":1821,"children":1822},{"emptyLinePlaceholder":275},[1823],{"type":53,"value":278},{"type":48,"tag":221,"props":1825,"children":1826},{"class":223,"line":271},[1827],{"type":48,"tag":221,"props":1828,"children":1829},{"style":228},[1830],{"type":53,"value":1831},"# Verify certificate chain\n",{"type":48,"tag":221,"props":1833,"children":1834},{"class":223,"line":281},[1835,1839,1844,1849,1854],{"type":48,"tag":221,"props":1836,"children":1837},{"style":237},[1838],{"type":53,"value":683},{"type":48,"tag":221,"props":1840,"children":1841},{"style":243},[1842],{"type":53,"value":1843}," verify",{"type":48,"tag":221,"props":1845,"children":1846},{"style":243},[1847],{"type":53,"value":1848}," -CAfile",{"type":48,"tag":221,"props":1850,"children":1851},{"style":243},[1852],{"type":53,"value":1853}," ca.crt",{"type":48,"tag":221,"props":1855,"children":1856},{"style":243},[1857],{"type":53,"value":1858}," client.crt\n",{"type":48,"tag":221,"props":1860,"children":1861},{"class":223,"line":290},[1862],{"type":48,"tag":221,"props":1863,"children":1864},{"emptyLinePlaceholder":275},[1865],{"type":53,"value":278},{"type":48,"tag":221,"props":1867,"children":1868},{"class":223,"line":848},[1869],{"type":48,"tag":221,"props":1870,"children":1871},{"style":228},[1872],{"type":53,"value":1873},"# Test TLS connection to cluster\n",{"type":48,"tag":221,"props":1875,"children":1876},{"class":223,"line":857},[1877,1881,1886,1891,1895,1900,1904,1908,1913,1917],{"type":48,"tag":221,"props":1878,"children":1879},{"style":237},[1880],{"type":53,"value":683},{"type":48,"tag":221,"props":1882,"children":1883},{"style":243},[1884],{"type":53,"value":1885}," s_client",{"type":48,"tag":221,"props":1887,"children":1888},{"style":243},[1889],{"type":53,"value":1890}," -connect",{"type":48,"tag":221,"props":1892,"children":1893},{"style":314},[1894],{"type":53,"value":453},{"type":48,"tag":221,"props":1896,"children":1897},{"style":243},[1898],{"type":53,"value":1899},"hos",{"type":48,"tag":221,"props":1901,"children":1902},{"style":461},[1903],{"type":53,"value":648},{"type":48,"tag":221,"props":1905,"children":1906},{"style":314},[1907],{"type":53,"value":629},{"type":48,"tag":221,"props":1909,"children":1910},{"style":243},[1911],{"type":53,"value":1912},":26257",{"type":48,"tag":221,"props":1914,"children":1915},{"style":243},[1916],{"type":53,"value":1848},{"type":48,"tag":221,"props":1918,"children":1919},{"style":243},[1920],{"type":53,"value":1921}," ca.crt\n",{"type":48,"tag":221,"props":1923,"children":1924},{"class":223,"line":908},[1925],{"type":48,"tag":221,"props":1926,"children":1927},{"emptyLinePlaceholder":275},[1928],{"type":53,"value":278},{"type":48,"tag":221,"props":1930,"children":1931},{"class":223,"line":936},[1932],{"type":48,"tag":221,"props":1933,"children":1934},{"style":228},[1935],{"type":53,"value":1936},"# Check certificate expiry date\n",{"type":48,"tag":221,"props":1938,"children":1939},{"class":223,"line":949},[1940,1944,1948,1952,1956,1960],{"type":48,"tag":221,"props":1941,"children":1942},{"style":237},[1943],{"type":53,"value":683},{"type":48,"tag":221,"props":1945,"children":1946},{"style":243},[1947],{"type":53,"value":867},{"type":48,"tag":221,"props":1949,"children":1950},{"style":243},[1951],{"type":53,"value":877},{"type":48,"tag":221,"props":1953,"children":1954},{"style":243},[1955],{"type":53,"value":1806},{"type":48,"tag":221,"props":1957,"children":1958},{"style":243},[1959],{"type":53,"value":1572},{"type":48,"tag":221,"props":1961,"children":1962},{"style":243},[1963],{"type":53,"value":1577},{"type":48,"tag":380,"props":1965,"children":1967},{"id":1966},"part-4-mtls-for-cdc-changefeeds-to-kafka",[1968],{"type":53,"value":1969},"Part 4: mTLS for CDC Changefeeds to Kafka",{"type":48,"tag":56,"props":1971,"children":1972},{},[1973],{"type":53,"value":1974},"CockroachDB CDC changefeeds can use mTLS to authenticate to Kafka brokers.",{"type":48,"tag":210,"props":1976,"children":1980},{"className":1977,"code":1978,"language":1979,"meta":215,"style":215},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","-- Create a changefeed with mTLS authentication to Kafka\nCREATE CHANGEFEED FOR TABLE orders\n  INTO 'kafka:\u002F\u002F\u003Ckafka-broker>:9093?tls_enabled=true&ca_cert=\u003Cbase64-ca>&client_cert=\u003Cbase64-cert>&client_key=\u003Cbase64-key>'\n  WITH updated, resolved;\n","sql",[1981],{"type":48,"tag":132,"props":1982,"children":1983},{"__ignoreMap":215},[1984,1992,2000,2008],{"type":48,"tag":221,"props":1985,"children":1986},{"class":223,"line":224},[1987],{"type":48,"tag":221,"props":1988,"children":1989},{},[1990],{"type":53,"value":1991},"-- Create a changefeed with mTLS authentication to Kafka\n",{"type":48,"tag":221,"props":1993,"children":1994},{"class":223,"line":29},[1995],{"type":48,"tag":221,"props":1996,"children":1997},{},[1998],{"type":53,"value":1999},"CREATE CHANGEFEED FOR TABLE orders\n",{"type":48,"tag":221,"props":2001,"children":2002},{"class":223,"line":25},[2003],{"type":48,"tag":221,"props":2004,"children":2005},{},[2006],{"type":53,"value":2007},"  INTO 'kafka:\u002F\u002F\u003Ckafka-broker>:9093?tls_enabled=true&ca_cert=\u003Cbase64-ca>&client_cert=\u003Cbase64-cert>&client_key=\u003Cbase64-key>'\n",{"type":48,"tag":221,"props":2009,"children":2010},{"class":223,"line":271},[2011],{"type":48,"tag":221,"props":2012,"children":2013},{},[2014],{"type":53,"value":2015},"  WITH updated, resolved;\n",{"type":48,"tag":56,"props":2017,"children":2018},{},[2019],{"type":48,"tag":113,"props":2020,"children":2021},{},[2022],{"type":53,"value":2023},"Preparing certificates for changefeed URI:",{"type":48,"tag":210,"props":2025,"children":2027},{"className":212,"code":2026,"language":214,"meta":215,"style":215},"# Base64 encode certificates for use in changefeed URI\ncat ca.crt | base64 -w 0    # Linux\ncat ca.crt | base64          # macOS\n\ncat client.crt | base64 -w 0\ncat client.key | base64 -w 0\n",[2028],{"type":48,"tag":132,"props":2029,"children":2030},{"__ignoreMap":215},[2031,2039,2076,2100,2107,2136],{"type":48,"tag":221,"props":2032,"children":2033},{"class":223,"line":224},[2034],{"type":48,"tag":221,"props":2035,"children":2036},{"style":228},[2037],{"type":53,"value":2038},"# Base64 encode certificates for use in changefeed URI\n",{"type":48,"tag":221,"props":2040,"children":2041},{"class":223,"line":29},[2042,2047,2051,2056,2061,2066,2071],{"type":48,"tag":221,"props":2043,"children":2044},{"style":237},[2045],{"type":53,"value":2046},"cat",{"type":48,"tag":221,"props":2048,"children":2049},{"style":243},[2050],{"type":53,"value":1853},{"type":48,"tag":221,"props":2052,"children":2053},{"style":314},[2054],{"type":53,"value":2055}," |",{"type":48,"tag":221,"props":2057,"children":2058},{"style":237},[2059],{"type":53,"value":2060}," base64",{"type":48,"tag":221,"props":2062,"children":2063},{"style":243},[2064],{"type":53,"value":2065}," -w",{"type":48,"tag":221,"props":2067,"children":2068},{"style":724},[2069],{"type":53,"value":2070}," 0",{"type":48,"tag":221,"props":2072,"children":2073},{"style":228},[2074],{"type":53,"value":2075},"    # Linux\n",{"type":48,"tag":221,"props":2077,"children":2078},{"class":223,"line":25},[2079,2083,2087,2091,2095],{"type":48,"tag":221,"props":2080,"children":2081},{"style":237},[2082],{"type":53,"value":2046},{"type":48,"tag":221,"props":2084,"children":2085},{"style":243},[2086],{"type":53,"value":1853},{"type":48,"tag":221,"props":2088,"children":2089},{"style":314},[2090],{"type":53,"value":2055},{"type":48,"tag":221,"props":2092,"children":2093},{"style":237},[2094],{"type":53,"value":2060},{"type":48,"tag":221,"props":2096,"children":2097},{"style":228},[2098],{"type":53,"value":2099},"          # macOS\n",{"type":48,"tag":221,"props":2101,"children":2102},{"class":223,"line":271},[2103],{"type":48,"tag":221,"props":2104,"children":2105},{"emptyLinePlaceholder":275},[2106],{"type":53,"value":278},{"type":48,"tag":221,"props":2108,"children":2109},{"class":223,"line":281},[2110,2114,2119,2123,2127,2131],{"type":48,"tag":221,"props":2111,"children":2112},{"style":237},[2113],{"type":53,"value":2046},{"type":48,"tag":221,"props":2115,"children":2116},{"style":243},[2117],{"type":53,"value":2118}," client.crt",{"type":48,"tag":221,"props":2120,"children":2121},{"style":314},[2122],{"type":53,"value":2055},{"type":48,"tag":221,"props":2124,"children":2125},{"style":237},[2126],{"type":53,"value":2060},{"type":48,"tag":221,"props":2128,"children":2129},{"style":243},[2130],{"type":53,"value":2065},{"type":48,"tag":221,"props":2132,"children":2133},{"style":724},[2134],{"type":53,"value":2135}," 0\n",{"type":48,"tag":221,"props":2137,"children":2138},{"class":223,"line":290},[2139,2143,2148,2152,2156,2160],{"type":48,"tag":221,"props":2140,"children":2141},{"style":237},[2142],{"type":53,"value":2046},{"type":48,"tag":221,"props":2144,"children":2145},{"style":243},[2146],{"type":53,"value":2147}," client.key",{"type":48,"tag":221,"props":2149,"children":2150},{"style":314},[2151],{"type":53,"value":2055},{"type":48,"tag":221,"props":2153,"children":2154},{"style":237},[2155],{"type":53,"value":2060},{"type":48,"tag":221,"props":2157,"children":2158},{"style":243},[2159],{"type":53,"value":2065},{"type":48,"tag":221,"props":2161,"children":2162},{"style":724},[2163],{"type":53,"value":2135},{"type":48,"tag":62,"props":2165,"children":2167},{"id":2166},"safety-considerations",[2168],{"type":53,"value":2169},"Safety Considerations",{"type":48,"tag":2171,"props":2172,"children":2173},"table",{},[2174,2198],{"type":48,"tag":2175,"props":2176,"children":2177},"thead",{},[2178],{"type":48,"tag":2179,"props":2180,"children":2181},"tr",{},[2182,2188,2193],{"type":48,"tag":2183,"props":2184,"children":2185},"th",{},[2186],{"type":53,"value":2187},"Impact Type",{"type":48,"tag":2183,"props":2189,"children":2190},{},[2191],{"type":53,"value":2192},"Severity",{"type":48,"tag":2183,"props":2194,"children":2195},{},[2196],{"type":53,"value":2197},"Recommendation",{"type":48,"tag":2199,"props":2200,"children":2201},"tbody",{},[2202,2221,2239,2256],{"type":48,"tag":2179,"props":2203,"children":2204},{},[2205,2211,2216],{"type":48,"tag":2206,"props":2207,"children":2208},"td",{},[2209],{"type":53,"value":2210},"Client CA upload",{"type":48,"tag":2206,"props":2212,"children":2213},{},[2214],{"type":53,"value":2215},"Low",{"type":48,"tag":2206,"props":2217,"children":2218},{},[2219],{"type":53,"value":2220},"Does not affect existing connections; only adds a new trust root",{"type":48,"tag":2179,"props":2222,"children":2223},{},[2224,2229,2234],{"type":48,"tag":2206,"props":2225,"children":2226},{},[2227],{"type":53,"value":2228},"Client CA removal",{"type":48,"tag":2206,"props":2230,"children":2231},{},[2232],{"type":53,"value":2233},"High",{"type":48,"tag":2206,"props":2235,"children":2236},{},[2237],{"type":53,"value":2238},"Invalidates all client certificates signed by that CA",{"type":48,"tag":2179,"props":2240,"children":2241},{},[2242,2247,2251],{"type":48,"tag":2206,"props":2243,"children":2244},{},[2245],{"type":53,"value":2246},"Certificate expiry",{"type":48,"tag":2206,"props":2248,"children":2249},{},[2250],{"type":53,"value":2233},{"type":48,"tag":2206,"props":2252,"children":2253},{},[2254],{"type":53,"value":2255},"Monitor expiry dates; rotate before expiration",{"type":48,"tag":2179,"props":2257,"children":2258},{},[2259,2264,2269],{"type":48,"tag":2206,"props":2260,"children":2261},{},[2262],{"type":53,"value":2263},"Wrong CA certificate",{"type":48,"tag":2206,"props":2265,"children":2266},{},[2267],{"type":53,"value":2268},"Medium",{"type":48,"tag":2206,"props":2270,"children":2271},{},[2272],{"type":53,"value":2273},"Clients will fail to connect; correctable by updating the CA cert",{"type":48,"tag":56,"props":2275,"children":2276},{},[2277],{"type":48,"tag":113,"props":2278,"children":2279},{},[2280],{"type":53,"value":2281},"Do not:",{"type":48,"tag":69,"props":2283,"children":2284},{},[2285,2290,2295,2300],{"type":48,"tag":73,"props":2286,"children":2287},{},[2288],{"type":53,"value":2289},"Delete the CA private key — it is required for signing new certificates",{"type":48,"tag":73,"props":2291,"children":2292},{},[2293],{"type":53,"value":2294},"Upload an expired CA certificate",{"type":48,"tag":73,"props":2296,"children":2297},{},[2298],{"type":53,"value":2299},"Remove a Client CA while clients still depend on it",{"type":48,"tag":73,"props":2301,"children":2302},{},[2303],{"type":53,"value":2304},"Disable TLS on production clusters (CockroachDB Cloud does not allow this)",{"type":48,"tag":62,"props":2306,"children":2308},{"id":2307},"rollback",[2309],{"type":53,"value":2310},"Rollback",{"type":48,"tag":56,"props":2312,"children":2313},{},[2314],{"type":48,"tag":113,"props":2315,"children":2316},{},[2317],{"type":53,"value":2318},"Cloud — Client CA issues:",{"type":48,"tag":1084,"props":2320,"children":2321},{},[2322,2327,2332],{"type":48,"tag":73,"props":2323,"children":2324},{},[2325],{"type":53,"value":2326},"If a new Client CA was uploaded incorrectly, upload the correct CA",{"type":48,"tag":73,"props":2328,"children":2329},{},[2330],{"type":53,"value":2331},"If client certificates are rejected, revert to password authentication temporarily",{"type":48,"tag":73,"props":2333,"children":2334},{},[2335],{"type":53,"value":2336},"Contact CockroachDB support if the cluster CA needs intervention",{"type":48,"tag":56,"props":2338,"children":2339},{},[2340],{"type":48,"tag":113,"props":2341,"children":2342},{},[2343],{"type":53,"value":2344},"Self-hosted — Certificate issues:",{"type":48,"tag":1084,"props":2346,"children":2347},{},[2348,2353,2364],{"type":48,"tag":73,"props":2349,"children":2350},{},[2351],{"type":53,"value":2352},"Restore previous certificates from backup",{"type":48,"tag":73,"props":2354,"children":2355},{},[2356,2358],{"type":53,"value":2357},"Reload certificates: ",{"type":48,"tag":132,"props":2359,"children":2361},{"className":2360},[],[2362],{"type":53,"value":2363},"kill -SIGHUP $(pgrep cockroach)",{"type":48,"tag":73,"props":2365,"children":2366},{},[2367],{"type":53,"value":2368},"If CA was rotated, ensure all nodes and clients have the new CA",{"type":48,"tag":62,"props":2370,"children":2372},{"id":2371},"references",[2373],{"type":53,"value":2374},"References",{"type":48,"tag":56,"props":2376,"children":2377},{},[2378],{"type":48,"tag":113,"props":2379,"children":2380},{},[2381],{"type":53,"value":2382},"Skill references:",{"type":48,"tag":69,"props":2384,"children":2385},{},[2386,2396],{"type":48,"tag":73,"props":2387,"children":2388},{},[2389,2394],{"type":48,"tag":1056,"props":2390,"children":2391},{"href":1058},[2392],{"type":53,"value":2393},"Client connection examples",{"type":53,"value":2395}," — Connection strings for common clients",{"type":48,"tag":73,"props":2397,"children":2398},{},[2399,2404],{"type":48,"tag":1056,"props":2400,"children":2401},{"href":1662},[2402],{"type":53,"value":2403},"TLS troubleshooting guide",{"type":53,"value":2405}," — Common SSL\u002FTLS errors and fixes",{"type":48,"tag":56,"props":2407,"children":2408},{},[2409],{"type":48,"tag":113,"props":2410,"children":2411},{},[2412],{"type":53,"value":2413},"Related skills:",{"type":48,"tag":69,"props":2415,"children":2416},{},[2417,2428],{"type":48,"tag":73,"props":2418,"children":2419},{},[2420,2426],{"type":48,"tag":1056,"props":2421,"children":2423},{"href":2422},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[2424],{"type":53,"value":2425},"auditing-cloud-cluster-security",{"type":53,"value":2427}," — Run a full security posture audit",{"type":48,"tag":73,"props":2429,"children":2430},{},[2431,2437],{"type":48,"tag":1056,"props":2432,"children":2434},{"href":2433},"..\u002Fconfiguring-sso-and-scim\u002FSKILL.md",[2435],{"type":53,"value":2436},"configuring-sso-and-scim",{"type":53,"value":2438}," — SSO as an alternative to certificate-based auth",{"type":48,"tag":56,"props":2440,"children":2441},{},[2442],{"type":48,"tag":113,"props":2443,"children":2444},{},[2445],{"type":53,"value":2446},"Official CockroachDB Documentation:",{"type":48,"tag":69,"props":2448,"children":2449},{},[2450,2461,2471,2481,2491,2501,2511],{"type":48,"tag":73,"props":2451,"children":2452},{},[2453],{"type":48,"tag":1056,"props":2454,"children":2458},{"href":2455,"rel":2456},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Ftransport-layer-security.html",[2457],"nofollow",[2459],{"type":53,"value":2460},"Transport Layer Security (TLS)",{"type":48,"tag":73,"props":2462,"children":2463},{},[2464],{"type":48,"tag":1056,"props":2465,"children":2468},{"href":2466,"rel":2467},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fauthentication.html",[2457],[2469],{"type":53,"value":2470},"Authentication",{"type":48,"tag":73,"props":2472,"children":2473},{},[2474],{"type":48,"tag":1056,"props":2475,"children":2478},{"href":2476,"rel":2477},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fconnection-parameters.html",[2457],[2479],{"type":53,"value":2480},"Client Connection Parameters",{"type":48,"tag":73,"props":2482,"children":2483},{},[2484],{"type":48,"tag":1056,"props":2485,"children":2488},{"href":2486,"rel":2487},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcockroach-cert.html",[2457],[2489],{"type":53,"value":2490},"cockroach cert Commands",{"type":48,"tag":73,"props":2492,"children":2493},{},[2494],{"type":48,"tag":1056,"props":2495,"children":2498},{"href":2496,"rel":2497},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frotate-certificates.html",[2457],[2499],{"type":53,"value":2500},"Rotate Security Certificates",{"type":48,"tag":73,"props":2502,"children":2503},{},[2504],{"type":48,"tag":1056,"props":2505,"children":2508},{"href":2506,"rel":2507},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fauthentication.html",[2457],[2509],{"type":53,"value":2510},"Cloud Certificate Management",{"type":48,"tag":73,"props":2512,"children":2513},{},[2514],{"type":48,"tag":1056,"props":2515,"children":2518},{"href":2516,"rel":2517},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fchangefeed-sinks.html#kafka",[2457],[2519],{"type":53,"value":2520},"CDC Kafka Sink",{"type":48,"tag":2522,"props":2523,"children":2524},"style",{},[2525],{"type":53,"value":2526},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2528,"total":2684},[2529,2548,2560,2575,2586,2596,2607,2619,2633,2648,2658,2671],{"slug":2530,"name":2530,"fn":2531,"description":2532,"org":2533,"tags":2534,"stars":2545,"repoUrl":2546,"updatedAt":2547},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2535,2536,2539,2542],{"name":23,"slug":24,"type":15},{"name":2537,"slug":2538,"type":15},"Incident Response","incident-response",{"name":2540,"slug":2541,"type":15},"Kubernetes","kubernetes",{"name":2543,"slug":2544,"type":15},"Monitoring","monitoring",105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":2549,"name":2549,"fn":2550,"description":2551,"org":2552,"tags":2553,"stars":2545,"repoUrl":2546,"updatedAt":2559},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2554,2557,2558],{"name":2555,"slug":2556,"type":15},"Deployment","deployment",{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":2561,"name":2561,"fn":2562,"description":2563,"org":2564,"tags":2565,"stars":2545,"repoUrl":2546,"updatedAt":2574},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2566,2567,2570,2571],{"name":23,"slug":24,"type":15},{"name":2568,"slug":2569,"type":15},"Debugging","debugging",{"name":2540,"slug":2541,"type":15},{"name":2572,"slug":2573,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":2576,"name":2576,"fn":2577,"description":2578,"org":2579,"tags":2580,"stars":2545,"repoUrl":2546,"updatedAt":2585},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2581,2582,2583,2584],{"name":23,"slug":24,"type":15},{"name":2568,"slug":2569,"type":15},{"name":2555,"slug":2556,"type":15},{"name":2540,"slug":2541,"type":15},"2026-07-12T07:57:24.018818",{"slug":2587,"name":2587,"fn":2588,"description":2589,"org":2590,"tags":2591,"stars":2545,"repoUrl":2546,"updatedAt":2595},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2592,2593,2594],{"name":23,"slug":24,"type":15},{"name":2555,"slug":2556,"type":15},{"name":2540,"slug":2541,"type":15},"2026-07-12T07:56:45.777567",{"slug":2597,"name":2597,"fn":2598,"description":2599,"org":2600,"tags":2601,"stars":2545,"repoUrl":2546,"updatedAt":2606},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2602,2603,2604,2605],{"name":23,"slug":24,"type":15},{"name":2555,"slug":2556,"type":15},{"name":2540,"slug":2541,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:56:47.082609",{"slug":2608,"name":2608,"fn":2609,"description":2610,"org":2611,"tags":2612,"stars":25,"repoUrl":26,"updatedAt":2618},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2613,2614,2615],{"name":23,"slug":24,"type":15},{"name":2543,"slug":2544,"type":15},{"name":2616,"slug":2617,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":2620,"name":2620,"fn":2621,"description":2622,"org":2623,"tags":2624,"stars":25,"repoUrl":26,"updatedAt":2632},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2625,2628,2629,2630],{"name":2626,"slug":2627,"type":15},"Data Modeling","data-modeling",{"name":23,"slug":24,"type":15},{"name":2616,"slug":2617,"type":15},{"name":2631,"slug":1979,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":2634,"name":2634,"fn":2635,"description":2636,"org":2637,"tags":2638,"stars":25,"repoUrl":26,"updatedAt":2647},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2639,2642,2645,2646],{"name":2640,"slug":2641,"type":15},"Audit","audit",{"name":2643,"slug":2644,"type":15},"Compliance","compliance",{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":2425,"name":2425,"fn":2649,"description":2650,"org":2651,"tags":2652,"stars":25,"repoUrl":26,"updatedAt":2657},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2653,2654,2655,2656],{"name":2640,"slug":2641,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":2659,"name":2659,"fn":2660,"description":2661,"org":2662,"tags":2663,"stars":25,"repoUrl":26,"updatedAt":2670},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2664,2665,2668,2669],{"name":2640,"slug":2641,"type":15},{"name":2666,"slug":2667,"type":15},"Data Analysis","data-analysis",{"name":23,"slug":24,"type":15},{"name":2616,"slug":2617,"type":15},"2026-07-12T07:57:16.190081",{"slug":2672,"name":2672,"fn":2673,"description":2674,"org":2675,"tags":2676,"stars":25,"repoUrl":26,"updatedAt":2683},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2677,2678,2681,2682],{"name":23,"slug":24,"type":15},{"name":2679,"slug":2680,"type":15},"Engineering","engineering",{"name":2616,"slug":2617,"type":15},{"name":2631,"slug":1979,"type":15},"2026-07-12T07:57:26.543278",40,{"items":2686,"total":2738},[2687,2693,2700,2707,2714,2721,2728],{"slug":2608,"name":2608,"fn":2609,"description":2610,"org":2688,"tags":2689,"stars":25,"repoUrl":26,"updatedAt":2618},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2690,2691,2692],{"name":23,"slug":24,"type":15},{"name":2543,"slug":2544,"type":15},{"name":2616,"slug":2617,"type":15},{"slug":2620,"name":2620,"fn":2621,"description":2622,"org":2694,"tags":2695,"stars":25,"repoUrl":26,"updatedAt":2632},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2696,2697,2698,2699],{"name":2626,"slug":2627,"type":15},{"name":23,"slug":24,"type":15},{"name":2616,"slug":2617,"type":15},{"name":2631,"slug":1979,"type":15},{"slug":2634,"name":2634,"fn":2635,"description":2636,"org":2701,"tags":2702,"stars":25,"repoUrl":26,"updatedAt":2647},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2703,2704,2705,2706],{"name":2640,"slug":2641,"type":15},{"name":2643,"slug":2644,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":2425,"name":2425,"fn":2649,"description":2650,"org":2708,"tags":2709,"stars":25,"repoUrl":26,"updatedAt":2657},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2710,2711,2712,2713],{"name":2640,"slug":2641,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":2659,"name":2659,"fn":2660,"description":2661,"org":2715,"tags":2716,"stars":25,"repoUrl":26,"updatedAt":2670},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2717,2718,2719,2720],{"name":2640,"slug":2641,"type":15},{"name":2666,"slug":2667,"type":15},{"name":23,"slug":24,"type":15},{"name":2616,"slug":2617,"type":15},{"slug":2672,"name":2672,"fn":2673,"description":2674,"org":2722,"tags":2723,"stars":25,"repoUrl":26,"updatedAt":2683},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2724,2725,2726,2727],{"name":23,"slug":24,"type":15},{"name":2679,"slug":2680,"type":15},{"name":2616,"slug":2617,"type":15},{"name":2631,"slug":1979,"type":15},{"slug":2729,"name":2729,"fn":2730,"description":2731,"org":2732,"tags":2733,"stars":25,"repoUrl":26,"updatedAt":2737},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2734,2735,2736],{"name":23,"slug":24,"type":15},{"name":2616,"slug":2617,"type":15},{"name":2631,"slug":1979,"type":15},"2026-07-25T05:31:22.562808",34]