ApsaraDB RDS:Configure the SSL encryption feature

Impacts

• If you enable the SSL encryption feature, disable the SSL encryption feature, or update the SSL certificates, the RDS instance restarts, and a primary/secondary switchover is triggered. We recommend that you perform the operations during off-peak hours. Make sure that your application is configured to automatically reconnect to the RDS instance. You can modify the code of your application to enable automatic reconnection. If you update the SSL certificates for an RDS instance that runs MySQL 5.6 or MySQL 5.7, the RDS instance restarts. If you update the SSL certificates for an RDS instance that runs MySQL 8.0, the RDS instance does not restart. For more information about the impacts of an instance switchover, see Impacts of an instance switchover.

• After you enable the SSL encryption feature, encrypted connections significantly increase CPU utilization. We recommend that you enable the SSL encryption feature only if you need to encrypt the connections to the public endpoint of your RDS instance.

TLS versions

Transport Layer Security (TLS) is a widely used transport-layer security protocol that ensures the data privacy and security of Internet communication. Multiple TLS versions are available. The TLS versions that are supported by ApsaraDB RDS for MySQL instances vary based on the major engine versions of the RDS instances.

ssl_cipher configuration

ApsaraDB RDS for MySQL uses OpenSSL for TLS to provide secure communication. OpenSSL is upgraded to OpenSSL 3.0 for RDS instances that run MySQL 5.7 and a minor engine version of 20230831 and RDS instances that run MySQL 8.0 and a minor engine version of 20230930. By default, OpenSSL 3.0 no longer supports communication over TLSv1.0 and TLSv1.1. For more information, see OpenSSL documentation.

To ensure data compatibility in ApsaraDB RDS for MySQL, the value of the ssl_cipher parameter is changed to "ALL:@SECLEVEL=0" to support TLSv1.0 and TLSv1.1.

If your workloads use only TLSv1.2 or later, we recommend that you set the ssl_cipher parameter to an empty string ("") in the ApsaraDB RDS console to ensure higher security.

Step 1: Enable the SSL encryption feature for an RDS instance

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Data Security.

3. On the SSL tab of the page that appears, turn on the switch to the right of Disabled.

   Note

   If the SSL tab does not appear, you must check whether the RDS instance meets all requirements in Prerequisites.

4. In the dialog box that appears, select the endpoint that you want to protect and click OK.

   You can encrypt the connections to the internal or public endpoint based on your business requirements. You can encrypt the connections only to one endpoint.

5. The process to enable the SSL encryption feature requires approximately 1 minute to complete. You can refresh the page to view the status of the feature.

Step 2: Download the CA certificate

If you do not want to use the CA certificate, you can use the SSL encryption feature to encrypt the connections to the RDS instance. We recommend that you download and use the CA certificate. You can use the CA certificate to verify the server certificate that is received during an SSL handshake. This helps confirm the identity of the RDS instance and prevent man-in-the-middle attacks.

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Data Security.

3. On the SSL tab of the page that appears, click Download CA Certificate.

   The file that you downloaded is a package that contains the following files:

   • PEM file: suitable for most scenarios.

   • JKS file: suitable for Java applications. In most cases, the PEM-formatted CA certificate file must be imported to a truststore for conversion into a JKS file. You can use the JKS file in Java applications. The password of the file is apsaradb.

   • P7B file: suitable for a small number of Windows applications that require PKCS#7-formatted certificate files.

Step 3: Connect to the RDS instance from the database client

After you enable the SSL encryption feature, the type and settings of the client determine whether to encrypt the connections between the client and the RDS instance. For example, the connections from the client to the RDS instance may be encrypted by default. You can modify the settings or code of the client to enable connection encryption and verify the identity of the RDS instance.

mysql -h {Endpoint of the RDS instance} -u {Account of the RDS instance} -p --ssl-mode=PREFERRED

mysql -h {Endpoint of the RDS instance} -u {Account of the RDS instance} -p --ssl-mode=VERIFY_CA --ssl-ca={Path to the CA certificate}/ApsaraDB-CA-Chain.pem

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

package com.aliyun.sample;

import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.SQLException;

public class Sample {

    public static void main(String[] args) {

        Connection conn = null;
        MysqlDataSource mysqlDS=null;

        try{
            mysqlDS = new MysqlDataSource();
            //You can specify the sslMode property based on your business requirements. For more information about the options for this property, see the description in the "Command-line tool" section of this topic. 
            mysqlDS.setSslMode("VERIFY_IDENTITY");
          
            //The truststore is used to store the CA certificate. In this example, the truststore type is set to JKS. 
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            //You must replace the content following file:/ with the actual path to your ApsaraDB-CA-Chain.jks file. 
            mysqlDS.setTrustCertificateKeyStoreUrl("file:/D:\\ApsaraDB-CA-Chain\\ApsaraDB-CA-Chain.jks");
            //The password of the downloaded JKS file is fixed as apsaradb. 
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");
          
            //The endpoint of your RDS instance.
            mysqlDS.setServerName("rm-xxxxxx.mysql.rds.aliyuncs.com");
            //The port number of your RDS instance.
            mysqlDS.setPort(3306);
            //The username of the account that is used to connect to your RDS instance.
            mysqlDS.setUser("xxxxxx");
            //The password of the account that is used to connect to your RDS instance.
            mysqlDS.setPassword("xxxxxx");
            //The name of the database that you want to connect on your RDS instance.
            mysqlDS.setDatabaseName("xxxxxx");

            conn = mysqlDS.getConnection();

        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }

}

# Run the pip install pymysql command to install PyMySQL.


import pymysql

try:
    conn = pymysql.connect(host='******.mysql.rds.aliyuncs.com',user='*****',passwd='******',db='*****',ssl=True,
            ssl_ca='/path/to/path/ApsaraDB-CA-Chain.pem')
    cursor = conn.cursor()
    cursor.execute('select version()')
    data = cursor.fetchone()
    print('Database version:', data[0])
    cursor.close()
except pymysql.Error as e:
    print(e)

FAQ

Features

• How do I implement mutual authentication that verifies the identities of the server and client?

  In ApsaraDB RDS for MySQL, the client identity cannot be verified during an SSL handshake. You can use whitelists and account management to implement access control.

• How do I configure SSL encryption for the read/write splitting endpoint?

  For more information, see Configure SSL encryption for a dedicated proxy endpoint.

Troubleshooting

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

Related operations

• DescribeDBInstanceSSL

• ModifyDBInstanceSSL