The nodes use these certificates to establish secure connections with clients and with other nodes. This certificate is multi-functional: the same certificate is presented irrespective of whether the node is acting as a server or a client. Using digital certificates with CockroachDBĮach CockroachDB node in a secure cluster must have a node certificate, which is a TLS 1.3 certificate. Each CockroachDB node also acts as an HTTP server, providing both a browser UI DB console and the cluster API, which provides much of the same information as the DB console, but as a rest API suitable for programmatic access. SQL clients connections, including the CockroachDB CLI client and the various supported drivers and ORMs, connect directly to CockroachDB clusters using the CockroachDB SQL interface.Ī read-only monitoring service, which provides cluster and database details, and information useful for troubleshooting and performance tuning. Users may connect with CockroachDB Self-Hosted clusters in 2 main ways: If you want to know how to create CockroachDB security certificates, see Create Security Certificates.If you are unfamiliar with public key cryptography and digital certificates, you might want to skip over to the conceptual overview first and then come back to the Using digital certificates with CockroachDB section.If you are familiar with public key cryptography and digital certificates, then reading the Using digital certificates with CockroachDB section should be enough.It also offers a conceptual overview of public key cryptography and digital certificates. This document discusses how CockroachDB uses digital certificates and what your options are for configuring user authentication for SQL clients and the DB Console UI. CockroachDB requires TLS 1.3 digital certificates for inter-node authentication and accepts TLS 1.2 and TLS 1.3 certificates for client-node authentication.

Authentication refers to the act of verifying the identity of the other party in communication.

No client certificate presented