Database SSL Certificate Should Be Rotated After Every 90 Days
More Info:
Ensured that SSL certificates are rotated after every 90 daysRisk Level
MediumAddress
SecurityCompliance Standards
NISTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of not rotating the SSL certificate for a database in GCP after every 90 days, you can follow these steps using the GCP console:
- Go to the Google Cloud Console and select the project that contains the database that needs to be remediated.
- Navigate to the Cloud SQL instances page and select the instance that needs to be remediated.
- Click on the “Edit” button at the top of the page to edit the instance settings.
- Scroll down to the “SSL” section and click on “Change” next to “Server Certificate”.
- Select the option to “Create a new certificate” and enter the required information, such as the certificate name and the certificate expiration date.
- Click on “Create” to generate the new SSL certificate.
- Once the new certificate is created, click on “Save” to save the changes to the database instance.
- Finally, set up a reminder or schedule to rotate the SSL certificate every 90 days to ensure that the certificate is always up-to-date.
Using CLI
Using CLI
To remediate the misconfiguration of database SSL certificate rotation for GCP using GCP CLI, follow these steps:
- Open the Cloud Shell in the GCP Console.
- Run the following command to list all the available instances:
- Select the instance for which you want to rotate the SSL certificate and run the following command:
- Replace [INSTANCE_NAME] with the name of your instance.
- This command sets the validity period of the SSL certificate to 90 days. You can change the value as per your requirement.
- Once the command is executed successfully, the SSL certificate for the selected instance will be rotated every 90 days.
Using Python
Using Python
To remediate the misconfiguration of rotating the database SSL certificate after every 90 days in GCP using Python, follow the steps below:
- First, you need to create a Cloud Function in GCP to rotate the SSL certificate. To create a Cloud Function, follow the instructions given in the official documentation.
- After creating the Cloud Function, you need to write a Python script that will rotate the SSL certificate. Here is an example script:
-
In the above script, replace
your-instance-idandyour-database-idwith the actual IDs of your Spanner instance and database. - Deploy the Cloud Function by clicking on the “Deploy” button in the Cloud Function console.
- Finally, you need to schedule the Cloud Function to run every 90 days. To do this, go to the Cloud Scheduler console and create a new job. Set the frequency to “every 90 days” and the target to the Cloud Function you just created.