Configure SSL encryption on an ApsaraDB RDS for SQL Server instance

Precautions

• An SSL certificate remains valid for one year. Before the used SSL certificate expires, you must update its validity period. In addition, you must download the required SSL certificate file and configure the SSL certificate again. Otherwise, clients cannot connect to your RDS instance over an encrypted connection.
• SSL encryption may cause a significant increase in CPU utilization. We recommend that you enable SSL encryption only when you want to encrypt the connections with the public endpoint of your RDS instance. In most cases, connections with the internal endpoint of your RDS instance are secure and do not require SSL encryption.
• SSL encryption cannot be disabled after it is enabled. Proceed with caution.
• SSL encryption is not supported for the connections with the read/write splitting endpoint of your RDS instance.

Enable SSL encryption

1. Visit the RDS instance list, select a region above, and click the target instance ID.
2. In the left-side navigation pane, click Data Security.
3. Click the SSL Encryption tab.
4. In the SSL Settings section, turn on SSL Encryption.
5. In the dialog box that appears, select the endpoint that you want to protect, and click OK.
   Note You can encrypt the connection to the internal or public endpoint based on your business requirements. Only one connection can be encrypted.

   
6. Click Download CA Certificate to download the SSL certificate files as a compressed package.
   

   The compressed package contains the following files:

   • .p7b file: the SSL certificate file that is used for a Windows operating system.
   • .PEM file: the SSL certificate file that is used for an operating system or application that is not Windows-based.
   • .JKS file: the SSL certificate file that is stored in the Java-supported truststore. You can use this file to import the SSL certificate files from a CA certificate chain into Java-based applications. The default password is apsaradb.
     Note When you use the .JKS file in JDK 7 or JDK 8, open the jre/lib/security/java.security file on the host where your application resides. Then, modify the following two default JDK security configuration items:

     jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
     jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

     If you do not modify these configuration items, the following error is reported (in most cases, other similar errors are also caused by invalid Java security configurations):

     javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Configure an SSL certificate

Before your application or client can connect to your RDS instance, you must configure an SSL certificate on your application or client after you enable SSL encryption. In this section, MySQL Workbench is used as an example. If you use other applications or clients, see the related instructions.

1. Start MySQL Workbench.
2. Choose Database > Manage Connections.
3. Enable Use SSL and import the required SSL certificate file.
   

Update the validity period of an SSL certificate