This topic describes how to configure Secure Sockets Layer (SSL) encryption on your ApsaraDB RDS for SQL Server instance. You must enable SSL encryption on your RDS instance and install the SSL certificates issued by certificate authorities (CAs) on your application. SSL is used at the transport layer to encrypt network connections. This allows you to enhance the security and integrity of the transmitted data. However, SSL increases the response time.
Background information
Precautions
- An SSL certificate remains valid for one year. Before the used SSL certificate expires, you must update its validity period. In addition, you must download the required SSL certificate file and configure the SSL certificate again. Otherwise, clients cannot connect to your RDS instance over an encrypted connection.
- SSL encryption may cause a significant increase in CPU utilization. We recommend that you enable SSL encryption only when you want to encrypt the connections with the public endpoint of your RDS instance. In most cases, connections with the internal endpoint of your RDS instance are secure and do not require SSL encryption.
- SSL encryption cannot be disabled after it is enabled. Proceed with caution.
- SSL encryption is not supported for the connections with the read/write splitting endpoint of your RDS instance.
Enable SSL encryption
Configure an SSL certificate
Before your application or client can connect to your RDS instance, you must configure an SSL certificate on your application or client after you enable SSL encryption. In this section, MySQL Workbench is used as an example. If you use other applications or clients, see the related instructions.
Update the validity period of an SSL certificate
- The Update Validity operation causes your RDS instance to restart. Proceed with caution.
- After you perform the Update Validity operation, you must download the required SSL certificate file and configure the SSL certificate again.
