diff --git a/tool/tsh/common/db.go b/tool/tsh/common/db.go
index a726af1c46d51..b9bdaf18902a3 100644
--- a/tool/tsh/common/db.go
+++ b/tool/tsh/common/db.go
@@ -720,7 +720,7 @@ func prepareLocalProxyOptions(arg *localProxyConfig) ([]alpnproxy.LocalProxyConf
 
 	// no tunnel, check for protocol-specific cases
 	switch arg.dbInfo.Protocol {
-	case defaults.ProtocolPostgres:
+	case defaults.ProtocolPostgres, defaults.ProtocolCockroachDB:
 		// certs are needed for non-tunnel postgres cancel requests.
 		cert, err := loadDBCertificate(arg.tc, arg.dbInfo.ServiceName)
 		if err != nil {