Certificates for sidecars

The Cyral sidecar requires certificates to communicate in a secure way. The Cyral sidecar will by default install its own certificates as part of the deployment process, which we refer to as sidecar-created certificates. You may also choose to provide your own certificate, signed by yourself or the Certificate Authority (CA) of your choice, which we refer to as custom certificates.

Sidecar certificate types

The sidecar uses two types of certificate: a TLS certificate, and a CA certificate.

TLS. The TLS certificate is used handle TLS connections terminated at the sidecar. This is used by all Cyral repository types when communicating with TLS terminated at the sidecar.

CA. The CA certificate is used by the sidecar when it is acting as a proxy. It is not used for all Cyral repository types. Repository types that use this certificate include S3 and DynamoDB.

Sidecar-created certificate

If custom certificates are not provided by you, the sidecar will automatically install self-signed certificates. For those deployment templates provided by Cyral, these certificates will live as long as the sidecar is deployed. They are shared amongst multiple sidecar instances and will not be replaced during sidecar upgrades. If you are managing your own deployment code by using the Linux sidecar or managing directly a docker-based sidecar, the self-signed certificate will be automatically created per instance and you are responsible for providing a custom certificate should you want to share the same certificate across multiple instances.

The sidecar-created certificate domains correspond to the sidecar DNS name you provided during deployment. If you did not provide a DNS name, the certificate uses the DNS name sidecar.app.cyral.com

Custom certificate

Custom certificates are self-signed or CA-signed certificates managed outside the sidecar template. These certificates are not provided by Cyral. You must manually create them and manage their validity.

Once you've deployed a custom certificate, you can associate it with your sidecar by providing it to the deployment template you are using. This can be specified during a sidecar creation or upgrade.

note

It is your responsibility to manage the validity and renewal of a custom certificate. None of the templates will renew or control the validity of the certificate.

Store a certificate for the sidecar

To deploy custom certificates to your sidecar, refer to the Sidecar certificates documentation page of the sidecar deployment template of your choice in our quickstart page.