[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for PostgreSQL](../../index.md) > [Step-by-step guides](../index.md) > [Connection](index.md) > Updating a TLS certificate chain

# Updating a TLS certificate chain in data platform services

The TLS certificate chain will be updated in the service clusters associated with the Yandex Cloud data platform. This change is necessary because the current intermediate certificate expires on June 20, 2027.

During scheduled [maintenance](../../concepts/maintenance.md), cluster server certificates will be switched to a new intermediate certificate.


## Upcoming changes {#upcoming-changes}

* The `YandexCLCA` intermediate certificate will be replaced with a new one.
* The `YandexInternalRootCA` root certificate will not change.
* Cluster addresses, credentials, and connection parameters will not change.

* The date and time of the specific cluster update will be specified in the corresponding [maintenance task](../cluster-maintenance.md#get-maintenance).


## Possible problems {#possible-impact}

For most users, no additional actions are required when the certificate chain is updated. If the client trusts the `YandexInternalRootCA` root certificate and does not fix an intermediate certificate or specific server certificates, the connection will continue to operate.

Issues may occur after updating the certificate chain in the following cases:

* **Certificate fixing**. The client trusts only the current intermediate or server certificate. We recommend to avoid fixing such certificates: they are changed during routine rotation.
* **Own certificate store**. In [Java KeyStore](https://en.wikipedia.org/wiki/Java_KeyStore) or another secure certificate store (trust store), only the old intermediate certificate is imported and used.
* **`CA.pem` usage**. Certain import methods, in particular a single `keytool` call, add only the first (intermediate) chain certificate from this file.

If the client has not been configured to trust the new certificate chain, it will be unable to establish a TLS connection to the cluster after maintenance.

## Actions prior to maintenance {#to-do-list}

Check the settings of clients and applications that use TLS:

1. If `CA.pem` is used, switch to the [RootCA.pem](https://storage.yandexcloud.net/cloud-certs/RootCA.pem) root certificate.
1. If a custom secure certificate store is used, ensure that the `YandexInternalRootCA` root certificate has been imported into it.
1. Ensure that intermediate or server certificates are not pinned.
1. Perform a test connection with the updated settings.

For more details on certificate installation commands and connection examples, see [this section](index.md).


## If your connection drops {#troubleshoot}

Within three days from the update, you can run change rollback in the [management console](https://console.yandex.cloud). This will _temporarily_ allow you to use the previous TLS certificate chain for the connection.

After the connection is restored, update your secure certificate store or client configuration to match the main connection instruction. A change rollback is a temporary measure: the client must be prepared for working with the new certificate chain before the next switching.


#### Useful links {#see-also}

* [Pre-configuring a PostgreSQL cluster connection](index.md)
* [Maintenance in Managed Service for PostgreSQL](../../concepts/maintenance.md)
* [PostgreSQL cluster maintenance](../cluster-maintenance.md)