Routine Certificate Rotation

Rotate MariaDB Galera Cluster node certificates before expiry with no downtime, using hot reload and a validity-overlap window.

Node certificates should be replaced before they expire. Because certificates can be reloaded without a restart (see Reloading TLS Certificates Without Downtime), routine rotation needs no coordinated downtime.

To know when a node is approaching expiry, set wsrep_certificate_expiration_hours_warning. MariaDB Enterprise Cluster then logs a warning to the error log a configurable number of hours before the node's TLS certificate expires — use it to trigger rotation ahead of time.

Procedure

1. Issue a new certificate for each node from the same cluster CA, with a validity period that overlaps the current certificate (the new certificate should be valid before the old one expires).

2. Distribute each node's new certificate and key to that node.

3. On one node at a time, replace the files at their configured paths and run FLUSH SSL;.

4. Confirm the node is serving the new certificate and remains Synced.

5. Repeat for each node.

Keeping certificate lifetimes short is practical precisely because rotation is online. See Choosing a Certificate Authority for Galera Cluster.

See Also

• Reloading TLS Certificates Without Downtime

• Cluster CA Rotation

• Responding to a Key or Certificate Compromise

_{This page is licensed: CC BY-SA / Gnu FDL}