Can someone please explain what this means and how this can affect Cloud SQL?

Google Cloud Compute Infrastructure
1

What does this update mean for my Postgres Database server certificates?

2

Great question — this August 2025 update is a different change from the June 2026 GTS WE1 trust store rotation, and it’s worth understanding the distinction.

What the August 2025 notice covers:
Google is shifting some of its services from RSA leaf certificates to ECDSA leaf certificates in Q4 2025. This changes the algorithm used to sign the server’s end-entity certificate — not the root CA or intermediate CA in the chain. The trust anchors (root.crt, system CA bundle) do not change as a result of this update.

What this means specifically for Postgres:

  1. Cloud SQL users: If you connect to Cloud SQL, the server certificate your client receives will move from RSA to ECDSA. Your /etc/postgresql-common/root.crt file (which your client uses to verify the server) does not need to change — it points to the same root CA. What must work is your client’s ability to verify an ECDSA certificate. Any modern PostgreSQL driver using libssl/OpenSSL 1.1+ handles this automatically.

  2. Self-hosted Postgres on GCP: Not directly affected by this specific update. Your server certificate is issued by whatever CA you configured, not by Google. However, if your database containers or applications make outbound HTTPS calls to Google APIs, those connections are subject to both this change and the June 2026 WE1 rotation.

  3. The main risk for both cases: certificate pinning. If you have hardcoded an RSA certificate fingerprint or a specific certificate bytes anywhere — in a connection string, an application config, or an ssl_cert parameter — that will break when Google issues an ECDSA cert. Search your codebase and configs for any explicit SSL certificate pins against Google-issued certs.

For the June 2026 GTS WE1 trust store update (the deadline that has already passed), the fix is different: your OS CA bundle and/or JVM cacerts keystore must contain the Google Trust Services WE1 root. That is a trust store update, not a pinning or algorithm concern.

Quick checklist:

  • grep for “Google Trust Services” (not just “gts” as this could be anything else) is missing try connection strings for sslcert=, ssl_cert=, or SHA fingerprints pointing at Google certs with “Google Trust Services” annotation
  • Verify your libssl/OpenSSL version supports ECDSA (openssl version; any 1.1+ is fine)
  • Run: openssl x509 -in /etc/postgresql-common/root.crt -noout -issuer to confirm your root.crt is your internal CA, not a Google-issued cert
  • Trust pki.goog/roots.pem as your authoritative source — Google recommends never hardcoding CAs and syncing your trust store at least semi-annually

Reference: Google Trust Services | FAQ and contact