Updating a TLS certificate chain in data platform services
The TLS certificate chain will be updated in the service clusters associated with the Yandex Cloud data platform. This change is necessary because the current intermediate certificate expires on June 20, 2027.
During scheduled maintenance, cluster server certificates will be switched to a new intermediate certificate.
Upcoming changes
- The
YandexCLCAintermediate certificate will be replaced with a new one. - The
YandexInternalRootCAroot certificate will not change. - Cluster addresses, credentials, and connection parameters will not change.
- The date and time of the specific cluster update will be specified in the appropriate maintenance task.
Possible problems
For most users, no additional actions are required when the certificate chain is updated. If the client trusts the YandexInternalRootCA root certificate and does not fix an intermediate certificate or specific server certificates, the connection will continue to operate.
Issues may occur after updating the certificate chain in the following cases:
- Certificate fixing. The client trusts only the current intermediate or server certificate. We recommend to avoid fixing such certificates: they are changed during routine rotation.
- Own certificate store. In Java KeyStore or another secure certificate store (trust store), only the old intermediate certificate is imported and used.
CA.pemusage. Certain import methods, in particular a singlekeytoolcall, add only the first (intermediate) chain certificate from this file.
If the client has not been configured to trust the new certificate chain, it will be unable to establish a TLS connection to the cluster after maintenance.
Pre-maintenance checklist
Check the settings of clients and applications that use TLS:
- If
CA.pemis used, switch to the RootCA.pem root certificate. - If a custom secure certificate store is used, ensure that the
YandexInternalRootCAroot certificate has been imported into it. - Ensure that intermediate or server certificates are not pinned.
- Perform a test connection with the updated settings.
For more info on certificate installation commands and connection examples, see Pre-configuring a OpenSearch cluster connection.
If your connection drops
Within three days from the update, you can run change rollback in the management console. This will temporarily allow you to use the previous TLS certificate chain for the connection.
After the connection is restored, update your secure certificate store or client configuration to match the main connection instruction. A change rollback is a temporary measure: the client must be prepared for working with the new certificate chain before the next switching.