Ensure that all the server certificates configured for your Cloud SQL database instances are rotated before they are about expire. This will ensure that all incoming connections to your Cloud SQL database instances remain secure and the web clients use valid SSL certificates to connect to your databases.
If the SSL/TLS protocol is enforced for all incoming connections made to the Cloud SQL database instances, only authenticated clients with valid SSL certificates can access the SQL databases. When SSL certificates are not renewed (rotated) prior to their expiration date, they become invalid and the communication between the clients and the database instances is no longer secure and may become interrupted. Receiving notifications from Google Cloud about your server certificates expiring may help but this method does not guarantee success, therefore to reduce the chances of an interruption or to prevent insecure communication between your databases and their clients, it is strongly recommended to rotate the database server certificates before they expire.
Note: As example, this conformity rule demonstrates how to rotate (renew) the Cloud SQL server certificates within 30 days before expiration.
To determine if your server certificates are about to expire, perform the following operations:
Remediation / Resolution
To rotate an SSL server certificate that is about to expire in less than 30 days, configured for your Cloud SQL database instance, perform the following operations:
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
You are auditing:
Rotate Server Certificates for Cloud SQL Database Instances
Risk level: High