[Yandex Cloud documentation](../index.md) > [Yandex Managed Service for ClickHouse®](index.md) > Getting started
# Getting started with Managed Service for ClickHouse®
To get started:
* [Create a database cluster](#cluster-create).
* [Connect to the database](#connect).
## Getting started {#before-you-begin}
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or sign up if not signed up yet.
1. If you do not have a [folder](../resource-manager/concepts/resources-hierarchy.md#folder) yet, create one:
1. In the [management console](https://console.yandex.cloud), in the top panel, click  or  and select the [cloud](../resource-manager/concepts/resources-hierarchy.md#cloud).
1. To the right of the cloud name, click .
1. Select  **Create folder**.
1. Give your [folder](../resource-manager/concepts/resources-hierarchy.md#folder) a name. The naming requirements are as follows:
* Length: between 3 and 63 characters.
* It can only contain lowercase Latin letters, numbers, and hyphens.
* It must start with a letter and cannot end with a hyphen.
1. Optionally, specify the description for your folder.
1. Select **Create a default network**. This will create a [network](../vpc/concepts/network.md#network) with subnets in each availability zone. Within this network, you will also have a [default security group](../vpc/concepts/security-groups.md#default-security-group), within which all network traffic will be allowed.
1. Click **Create**.
1. [Assign](../iam/operations/roles/grant.md) the [vpc.user](../vpc/security/index.md#vpc-user) role and the [managed-clickhouse.editor role or higher](security.md#roles-list) to your Yandex Cloud account. These roles enable you to create a cluster.
To attach the service account to a cluster, e.g., to [use Yandex Object Storage](operations/s3-access.md), your account also needs the [iam.serviceAccounts.user](../iam/security/index.md#iam-serviceAccounts-user) role or higher.
{% note info %}
If you cannot manage roles, contact your cloud or organization administrator.
{% endnote %}
1. You can connect to database [clusters](concepts/index.md) from both inside and outside Yandex Cloud:
* To connect from inside Yandex Cloud, create a [Linux](../compute/quickstart/quick-create-linux.md)-based [VM](../compute/concepts/vm.md) in the same [network](../vpc/concepts/network.md#network) as the database cluster.
* To connect to the cluster from the internet, request public access to hosts when creating the cluster.
{% note info %}
In the next steps, you are assumed to connect to the cluster from a [Linux](../compute/quickstart/quick-create-linux.md)-based VM.
{% endnote %}
1. [Connect](../compute/operations/vm-connect/ssh.md) to your VM over SSH.
1. Add the ClickHouse® [DEB repository](https://clickhouse.com/docs/enen/install#install-from-deb-packages):
```bash
sudo apt update && sudo apt install --yes apt-transport-https ca-certificates dirmngr && \
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 8919F6BD******** && \
echo "deb https://packages.clickhouse.com/deb stable main" | sudo tee \
/etc/apt/sources.list.d/clickhouse.list
```
1. Install the dependencies and the `clickhouse-client` application:
```bash
sudo apt update && sudo apt install --yes clickhouse-client
```
1. Download the `clickhouse-client` configuration file:
```bash
mkdir -p ~/.clickhouse-client && \
wget "https://storage.yandexcloud.net/doc-files/clickhouse-client.conf.example" \
--output-document ~/.clickhouse-client/config.xml
```
## Create a cluster {#cluster-create}
1. In the management console, select the folder where you want to create your database cluster.
1. Navigate to **Managed Service for ClickHouse**.
1. Click **Create cluster**.
1. Specify the cluster settings and click **Create cluster**. For more information, see [Creating a cluster](operations/cluster-create.md).
1. Wait until the cluster is ready: its status on the Managed Service for ClickHouse® dashboard will change to **Running**, and its state to **Alive**. This may take a while.
## Connect to the database {#connect}
1. If you are using [security groups](../vpc/concepts/security-groups.md) for a cloud network, [configure them](operations/connect/index.md#configuring-security-groups) to allow all relevant traffic between the cluster and the connecting host.
1. To connect to the database server, get SSL certificates:
{% list tabs group=operating_system %}
- Linux (Bash) {#linux}
```bash
sudo mkdir --parents /usr/local/share/ca-certificates/Yandex/ && \
sudo wget "https://storage.yandexcloud.net/cloud-certs/RootCA.pem" \
--output-document /usr/local/share/ca-certificates/Yandex/RootCA.crt && \
sudo wget "https://storage.yandexcloud.net/cloud-certs/IntermediateCA.pem" \
--output-document /usr/local/share/ca-certificates/Yandex/IntermediateCA.crt && \
sudo chmod 655 \
/usr/local/share/ca-certificates/Yandex/RootCA.crt \
/usr/local/share/ca-certificates/Yandex/IntermediateCA.crt && \
sudo update-ca-certificates
```
The certificates will be saved to the following files:
* `/usr/local/share/ca-certificates/Yandex/RootCA.crt`
* `/usr/local/share/ca-certificates/Yandex/IntermediateCA.crt`
- macOS (Zsh) {#macos}
```bash
sudo mkdir -p /usr/local/share/ca-certificates/Yandex/ && \
sudo wget "https://storage.yandexcloud.net/cloud-certs/RootCA.pem" \
--output-document /usr/local/share/ca-certificates/Yandex/RootCA.crt && \
sudo wget "https://storage.yandexcloud.net/cloud-certs/IntermediateCA.pem" \
--output-document /usr/local/share/ca-certificates/Yandex/IntermediateCA.crt && \
sudo chmod 655 \
/usr/local/share/ca-certificates/Yandex/RootCA.crt \
/usr/local/share/ca-certificates/Yandex/IntermediateCA.crt && \
security import /usr/local/share/ca-certificates/Yandex/RootCA.crt -k ~/Library/Keychains/login.keychain; \
security import /usr/local/share/ca-certificates/Yandex/IntermediateCA.crt -k ~/Library/Keychains/login.keychain
```
The certificates will be saved to the following files:
* `/usr/local/share/ca-certificates/Yandex/RootCA.crt`
* `/usr/local/share/ca-certificates/Yandex/IntermediateCA.crt`
- Windows (PowerShell) {#windows}
1. Download and import the certificates:
```powershell
mkdir -Force $HOME\.yandex; `
curl.exe https://storage.yandexcloud.net/cloud-certs/RootCA.pem `
--output $HOME\.yandex\RootCA.crt; `
curl.exe https://storage.yandexcloud.net/cloud-certs/IntermediateCA.pem `
--output $HOME\.yandex\IntermediateCA.crt; `
Import-Certificate `
-FilePath $HOME\.yandex\RootCA.crt `
-CertStoreLocation cert:\CurrentUser\Root; `
Import-Certificate `
-FilePath $HOME\.yandex\IntermediateCA.crt `
-CertStoreLocation cert:\CurrentUser\Root
```
Your corporate security policies and antivirus software may block the certificate download. For more information, see [FAQ](qa/connection.md#get-ssl-error).
1. Agree to install the certificates in the Trusted Root Certification Authorities
storage.
The certificates will be saved to the following files:
* `$HOME\.yandex\RootCA.crt`
* `$HOME\.yandex\IntermediateCA.crt`
{% endlist %}
1. Use the ClickHouse® CLI to connect:
1. Specify the path to the `RootCA.crt` SSL certificate in the [configuration file](https://clickhouse.com/docs/enen/interfaces/cli#interfaces_cli_configuration), in the `` element:
```xml
true
/usr/local/share/ca-certificates/Yandex/RootCA.crt
true
sslv2,sslv3
true
RejectCertificateHandler
```
1. Run the ClickHouse® CLI with the following parameters:
```bash
clickhouse-client --host \
--secure \
--user \
--database \
--port 9440 \
--ask-password
```
## What's next {#whats-next}
* Read about the [service concepts](concepts/index.md).
* Learn more about [creating a cluster](operations/cluster-create.md) and [connecting to a database](operations/connect/index.md).
* Check out the [questions and answers](qa/general.md).
_ClickHouse® is a registered trademark of [ClickHouse, Inc](https://clickhouse.com)._