Create Security Certificates using a Custom CA

On this page

To secure your CockroachDB cluster's inter-node and client-node communication, you need to provide a Certificate Authority (CA) certificate that has been used to sign keys and certificates (SSLs) for:

• Nodes
• Clients
• DB Console (optional)

To create these certificates and keys, use the cockroach cert commands with the appropriate subcommands and flags, use openssl commands, or use a custom CA (for example, a public CA or your organizational CA).

This document discusses the following advanced use cases for using security certificates with CockroachDB:

Accessing the DB Console for a secure cluster

On accessing the DB Console for a secure cluster, your web browser will consider the CockroachDB-issued certificate invalid, because the browser hasn't been configured to trust the CA that issued the certificate.

For secure clusters, you can avoid getting the warning message by using a certificate issued by a public CA whose certificates are trusted by browsers, in addition to the CockroachDB-created certificates:

1. Request a certificate from a public CA (for example, Let's Encrypt). The certificate must have the IP addresses and DNS names used to reach the DB Console listed in the Subject Alternative Name field.
2. Rename the certificate and key as ui.crt and ui.key.
3. Add the ui.crt and ui.key to the certificate directory. ui.key must not have group or world permissions (maximum permissions are 0700, or rwx------). You can disable this check by setting the environment variable COCKROACH_SKIP_KEY_PERMISSION_CHECK=true.
4. For nodes that are already running, load the ui.crt certificate without restarting the node by issuing a SIGHUP signal to the cockroach process:

   pkill -SIGHUP -x cockroach

The SIGHUP signal must be sent by the same user running the process (e.g., run with sudo if the cockroach process is running under user root).

Node key and certificates

A node must have the following files with file names as specified in the table:

Client key and certificates

A client must have the following files with file names as specified in the table:

Split node certificates

The node certificate discussed in the cockroach cert command documentation is multifunctional, which means the same certificate is presented for the node's incoming connections (from SQL and DB Console clients, and from other CockroachDB nodes) and for outgoing connections to other CockroachDB nodes. To make the certificate multi-functional, the node.crt created using the cockroach cert command has CN=node and the list of IP addresses and DNS names listed in Subject Alternative Name field. This works if you are also using the CockroachDB CA created using the cockroach cert command. However, if you need to use an external public CA or your own organizational CA, the CA policy might not allow it to sign a server certificate containing a CN that is not an IP address or domain name.

To get around this issue, you can split the node key and certificate into two:

• node.crt and node.key: node.crt is used as the server certificate when a node receives incoming connections from clients and other nodes. All IP addresses and DNS names for the node must be listed in the Subject Alternative Name field.
• client.node.crt and client.node.key: client.node.crt is used as the client certificate when making connections to other nodes. client.node.crt must have CN=node.

Node key and certificates

A node must have the following files with file names as specified in the table:

Optionally, if you have a certificate issued by a public CA to securely access the DB Console, you need to place the certificate and key (ui.crt and ui.key respectively) in the directory specified by the --certs-dir flag.

Client key and certificates

A client must have the following files with file names as specified in the table:

Split CA certificates

If you need to use separate CAs to sign node certificates and client certificates, then you need two CAs and their respective certificates and keys: ca.crt and ca-client.crt.

Node key and certificates

A node must have the following files with file names as specified in the table:

Optionally, if you have a certificate issued by a public CA to securely access the DB Console, you need to place the certificate and key (ui.crt and ui.key respectively) in the directory specified by the --certs-dir flag.

Client key and certificates

A client must have the following files with file names as specified in the table:

Certificate revocation with OCSP

CockroachDB now supports certificate revocation for custom CA certificate setups running an OCSP server.

To enable certificate revocation:

1. Ensure that your Certificate Authority sets the OCSP server address in the authorityInfoAccess field in the certificate.

2. Set the cluster setting security.ocsp.mode to lax (by default, the cluster setting is set to off).

     > SHOW CLUSTER SETTING security.ocsp.mode;
   

     security.ocsp.mode
     ----------------------
     off
     (1 row)
   
     Server Execution Time: 56µs
     Network Latency: 181µs
   

     > SET CLUSTER SETTING security.ocsp.mode = lax;
   

   For production clusters, you might want to set the setting to strict.

   Note:

   In the strict mode, all certificates are presumed to be invalid if the OCSP server is not reachable. Setting the cluster setting security.ocsp.mode to strict will lock you out of your CockroachDB database if your OCSP server goes down.

See also

• Manual Deployment: Learn about starting a multi-node secure cluster and accessing it from a client.
• Start a Node: Learn more about the flags you pass when adding a node to a secure cluster
• Client Connection Parameters

Was this helpful?