# Updating SSL certificates on "percona:8.0" docker container

**URL:** <https://forums.percona.com/t/updating-ssl-certificates-on-percona-8-0-docker-container/25930>\
**Category:** Percona Server for MySQL\
**Created:** [October 16, 2023, 9:22am UTC](https://forums.percona.com/t/updating-ssl-certificates-on-percona-8-0-docker-container/25930 "2023-10-16T09:22:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nunop](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@nunop](https://forums.percona.com/u/nunop)\
**Post date:** [October 16, 2023, 9:22am UTC](https://forums.percona.com/t/updating-ssl-certificates-on-percona-8-0-docker-container/25930/1 "2023-10-16T09:22:46Z")

</div>

Hello,

I use LetsEncrypt certificates for all my services, and mount those certificates against the Percona MySQL docker container:

docker-compose.yml:

```
volumes:
  - /path/to/certs/:/etc/my.cnf.d/certs/:ro

```

my.cnf:

```
[mysqld]
ssl_cert = "/etc/my.cnf.d/certs/fullchain.pem"
ssl_key = "/etc/my.cnf.d/certs/privkey.pem"

```

If I update those certificates in the Host, do I need to do anything on the container, such as either restarting or run “FLUSH SSL;”, or will the container handle the certificates being updated?

Also, I noticed that even though I have my own certificates, Percona has gone ahead and generated some Server and Client certificates inside the local /var/lib/mysql/ folder. I wonder if it’s really using my own certificates, although the paths seem to be the ones I provided, when I look at the live variables on the server. So I’m not sure what the certificates created inside /var/lib/mysql/ are used for.

Many thanks!

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [October 16, 2023, 2:44pm UTC](https://forums.percona.com/t/updating-ssl-certificates-on-percona-8-0-docker-container/25930/2 "2023-10-16T14:44:27Z")

</div>

Try this  
[https://dev.mysql.com/doc/refman/8.0/en/alter-instance.html#alter-instance-reload-tls](https://dev.mysql.com/doc/refman/8.0/en/alter-instance.html#alter-instance-reload-tls)

MySQL automatically generates self-signed certs on first start. That’s why you see certs inside /var/lib/mysql

If the running variables show the path of your certs, then it’s using yours.

---

<div class="post-metadata">

**Author:** ![nunop](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@nunop](https://forums.percona.com/u/nunop)\
**Post date:** [October 16, 2023, 2:54pm UTC](https://forums.percona.com/t/updating-ssl-certificates-on-percona-8-0-docker-container/25930/3 "2023-10-16T14:54:12Z")

</div>

Thank you very much, @matthewb

And am I right to say that as of 8.0.16, the new certificates will automatically be used on new connections, so I don’t need to restart the Docker container when I update my own certificates in the mounted volume?

Very kind regards!

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [October 16, 2023, 6:54pm UTC](https://forums.percona.com/t/updating-ssl-certificates-on-percona-8-0-docker-container/25930/4 "2023-10-16T18:54:38Z")

</div>

As far as I can tell, no, you don’t need to restart the container.