0

I am connecting to a GCP Cloud SQL instance using a client certificate issued by the GCP Cloud SQL service. When I created the client key-pair GCP Cloud SQL gave me three files: a server certificate, a client private key, and a client certificate. I was able to successfully connect using MySQL Workbench where I set the "SSL" setting to "Require and Verify CA".

When I look at the server certificate it says the issuer and subject are, respectively,

dnQualifier = b35cbfcb-fc96-47d4-6536-1f0e3313eeaf, CN = Google Cloud SQL Server CA, O = "Google, Inc", C = US
dnQualifier = b35cbfcb-fc96-47d4-6536-1f0e3313eeaf, CN = Google Cloud SQL Server CA, O = "Google, Inc", C = US

When I look at the client certificate it says the issuer and subject are, respectively,

dnQualifier = 6772fe8a-0e7c-4803-7fc5-67dbeaaba89c, CN = Google Cloud SQL Client CA certdb, O = "Google, Inc", C = US
CN = certdb, O = "Google, Inc", C = US

I thought the client certificate had to be signed by the server certificate but clearly that is not the case. Can someone explain how the TLS connection works when the client certificate is not signed by the server certificate?

Improve this question
1
  • In Google Cloud SQL, the client certificate is used for mutual authentication and encryption. The client certificate is issued by Google and is known to Google Cloud SQL and normally, it does not matter to your code or the TLS connection who signed it. IIRC, SQL clients perform no validation of a client certificate beyond validating the correct format and content. It is up to the server application (Cloud SQL) to validate the certificate presented during the authentication phase. The primary** purpose of the Cloud SQL client certificate is encryption.
    – John Hanley
    Commented Apr 5 at 17:20

1 Answer 1

Reset to default
1

An SSL certificate (any, not just client) must be signed by a certificate authority (CA). I guess the server could also be a CA, but that would be wrong. Normally a CA is a separate entity that the server trusts, so it could also trust the client certificates signed by that trusted authority -- which is the case in your example.

In a properly configured system the server certificate would also be signed by a CA that the client trusts, so the client could also know it's connecting to the correct server, but in your case the server has a self-signed certificate.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.