PolarDB:Configure SSL encryption

Step 1: Enable SSL encryption

1. Log on to the PolarDB console. In the upper-left corner, select the region where the cluster is deployed. In the navigation pane on the left, click Clusters. Then, click the ID of the cluster.

2. In the navigation pane on the left, choose Settings and Management > Security.

3. On the SSL Settings tab, click the slider next to SSL Status to enable SSL encryption.

   Note

   You can configure SSL for the primary endpoint, cluster endpoint, and custom endpoints.

4. In the Configure SSL dialog box, select the endpoint for which you want to enable SSL encryption, and click OK.

   Note

   You can choose to encrypt the private endpoint or the public endpoint as needed. However, you can encrypt only one endpoint at a time.

   

Step 2: Download the certificate

After you enable SSL encryption, you can download the certificate of the PolarDB cluster. The certificate is used to verify the authenticity of the database when a client remotely connects to the PolarDB cluster.

1. On the SSL Settings tab, click Download in the corresponding endpoint section.

   

2. The downloaded file is a compressed package that contains the following three files:

   • A .p7b file: Used to import the CA certificate on the Windows operating system.

   • A .pem file: Used to import the CA certificate on other operating systems or in other applications.

   • A .jks file: A truststore certificate file for Java. The password is `apsaradb`. This file is used to import the CA certificate chain into Java applications.

     Note

     If you use a JKS certificate file in Java, you must modify the default JDK security configuration for JDK 7 and JDK 8. On the server that connects to the PolarDB database, modify the following two configurations in the jre/lib/security/java.security file:

     jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
     jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

     If you do not modify the JDK security configuration, the following error is reported. Other similar errors are also typically caused by incorrect Java security configurations.

     javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Step 3: Connect to the PolarDB cluster from a client

After you enable SSL encryption, whether the connection between the client and the PolarDB cluster uses SSL encryption depends on the client type and settings. For example, some clients may use encrypted connections by default. You can modify the client settings or code to establish an encrypted connection and verify the identity of the PolarDB cluster.

mysql -h {endpoint} -u {username} -p --ssl-mode=PREFERRED

mysql -h {endpoint} -u {username} -p --ssl-mode=VERIFY_CA --ssl-ca={path_to_CA_certificate}/ApsaraDB-CA-Chain.pem

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

package com.example.ssltest;

import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class Main {
    public static void main(String[] args) {
       Connection conn = null;
        MysqlDataSource mysqlDS=null;

        try{
            mysqlDS = new MysqlDataSource();
            // Set SslMode as needed. For more information about the options for this property, see the command-line connection method.
            mysqlDS.setSslMode("VERIFY_IDENTITY");
          
            // The truststore is used to store the CA certificate. Set the truststore type to JKS.
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            // Replace the path after file:/ with the path to your ApsaraDB-CA-Chain.jks file.
            mysqlDS.setTrustCertificateKeyStoreUrl("file://{path_to_CA_certificate}/ApsaraDB-CA-Chain.jks");
            // The password for the downloaded JKS file is apsaradb and cannot be changed.
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");
          
            // Your database endpoint
            mysqlDS.setServerName("your_polardb_host");
            // Your database port
            mysqlDS.setPort(3306);
            // Your database username
            mysqlDS.setUser("your_username");
            // Your database password
            mysqlDS.setPassword("your_password");
            // Your database name
            mysqlDS.setDatabaseName("your_database");

            System.out.println("Attempting to connect to the database...");
            conn = mysqlDS.getConnection();
            System.out.println("Database connection successful!");
            
            // Use try-with-resources to ensure that Statement and ResultSet are automatically closed
            try (Statement stmt = conn.createStatement();
                 ResultSet rs = stmt.executeQuery("SELECT VERSION()")) {
                
                // Check if the query returned a result
                if (rs.next()) {
                    // Get the result from the first column and print it
                    String dbVersion = rs.getString(1);
                    System.out.println("Database version: " + dbVersion);
                } else {
                    System.out.println("Failed to retrieve database version information.");
                }
            }

        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }
}

# Install pymysql
# pip install pymysql

import pymysql

# --- Configure your database information ---
db_config = {
    'host': 'your_polardb_host',          # Your cluster endpoint
    'user': 'your_username',            # Your username
    'password': 'your_password',        # Your password
    'database': 'your_database',        # The database you want to connect to
    'port': 3306
}

# --- Configure SSL information ---
ssl_args = {
    'ca': '{path_to_CA_certificate}/ApsaraDB-CA-Chain.pem',
    'mode': 'VERIFY_CA'
}

try:
    # Establish a connection and pass the ssl parameter
    print("Attempting to connect to MySQL using SSL...")
    connection = pymysql.connect(**db_config, ssl=ssl_args)
    print("SSL connection successful!")

    with connection.cursor() as cursor:
        # Execute a simple query to verify the connection
        cursor.execute("SELECT VERSION()")
        version = cursor.fetchone()
        print(f"Database version: {version[0]}")

except pymysql.MySQLError as e:
    # Printing SSL-related errors can be helpful
    print(f"Connection failed: {e}")
finally:
    if 'connection' in locals() and connection.open:
        connection.close()
        print("Database connection closed.")

Step 4: Verify that the connection is encrypted

The SSL protocol has many versions. PolarDB currently supports TLSv1.2 and later versions. During the SSL handshake, the client and the PolarDB server negotiate connection parameters, such as the TLS version, cipher suite, and session key. For a detailed list of cipher suites, see the OpenSSL official website.

1. Use an SSL-configured client to connect to the PolarDB cluster.

2. Execute the following SQL query:

   SHOW STATUS LIKE 'ssl_cipher';
   
   +---------------+---------------------------+
   | Variable_name | Value                     |
   +---------------+---------------------------+
   | Ssl_cipher    | DHE-RSA-AES256-GCM-SHA384 |
   +---------------+---------------------------+

3. Analysis:

   • If the Value column returns a non-empty value (such as DHE-RSA-AES256-GCM-SHA384), the current connection is encrypted.

   • If the Value column is empty, the current connection is not encrypted. Check whether the client configuration is correct.

Modify the protected endpoint

To modify the SSL-protected endpoint, click Configure SSL in the corresponding endpoint section.

Update the certificate validity period

If you modified the SSL endpoint or the certificate is about to expire, you must manually update the certificate. This section describes how to update the certificate.

1. On the SSL Settings tab, click Update Validity Period.

   

2. In the dialog box that appears, click OK.

3. After you update the certificate, you must download and configure the new certificate.

Enable automatic certificate rotation

After you enable automatic certificate rotation, PolarDB automatically renews the certificate within the cluster's maintenance window in the 10 days before the certificate expires.

1. On the SSL Settings tab, click Advanced Settings.

2. In the Advanced Settings dialog box, enable automatic certificate rotation and click Confirm.

Disable SSL encryption

1. On the SSL Settings tab, click the slider next to SSL Status to disable SSL encryption.

2. In the dialog box that appears, click OK.