Share via

I received a notification from azure-noreply@microsoft.com regarding the upcoming root certificate rotation for Azure Database for MySQL Flexible Server

Shazad Mohammed 21 Reputation points
2025-07-20T22:24:17.51+00:00

Hello,

I received a notification from azure-noreply@microsoft.com regarding the upcoming root certificate rotation for Azure Database for MySQL Flexible Server, which must be completed before July 31, 2025.

I have Owner access to the server (company-portal-sql), but I do not have the admin username or password for the MySQL instance, as it was set up by someone who is no longer managing it.

I would like assistance in safely verifying whether SSL is in use and updating the root certificates without disrupting any current services or applications.

Please advise on the best course of action and whether it’s possible to retrieve or reset credentials without affecting production workloads.

Thank you.

Azure Database for MySQL
0 comments
Accepted answer
  1. Saraswathi Devadula 10,855 Reputation points Microsoft External Staff Moderator
    2025-07-21T03:59:43.3833333+00:00

    Hello Shazad Mohammed

    Based on the Azure documentation, specifically this part:
    You can identify whether your connections verify the root certificate by reviewing your connection string:

    If your connection string includes sslmode=verify-ca or sslmode=verify-identity, you need to update the trusted root certificates. You must deploy three root CA certificates to the client certificate store:

    • DigiCert Global Root G2 and Microsoft RSA Root CA 2017 root CA certificates, because services are migrating from Digicert to Microsoft CA.
    • Digicert Global Root CA, for legacy compatibility to avoid losing connections.
    • If your connection string includes sslmode=disable, sslmode=allow, sslmode=prefer, or sslmode=require, you don't need to update the trusted root certificates.
    • If your connection string doesn't specify sslmode, you don't need to update certificates.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Suman Shrestha 85 Reputation points
    2025-07-21T02:38:51.24+00:00

    Hi,

    I am in the same boat as you.

    Not sure if it has to be updated if the root cert verification was not used. Hope someone can help us here.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.