Configure SSL encryption - AnalyticDB - Alibaba Cloud Documentation Center

To enhance connection security, you can enable Secure Sockets Layer (SSL) encryption and install a CA certificate for your applications. SSL encrypts network connections at the transport layer to improve the security and integrity of data in transit. This prevents third parties from eavesdropping on, intercepting, or tampering with your data. However, enabling SSL may increase network connection latency. This topic describes how to enable and disable SSL encryption.

Important

This feature is in beta. The console interface and API operations are subject to change.

Prerequisites

The AnalyticDB for MySQL cluster must run kernel version 3.2.1.0 or later.

Note

To view and update the minor version, go to the Configuration Information section on the Cluster Information page in the AnalyticDB for MySQL console.

Background information

SSL is a security protocol developed by Netscape to establish a secure channel between browsers and web servers for data transmission. It uses encryption algorithms such as RC4, MD5, and RSA to ensure secure communication. The Internet Engineering Task Force (IETF) standardized SSL 3.0 and renamed it Transport Layer Security (TLS). Because SSL is the more common term, this topic uses SSL encryption to refer to TLS encryption.

Note

AnalyticDB for MySQL recommends that you use the TLS 1.2 protocol for secure communication.

Usage notes

An SSL certificate is valid for one year. Renew the certificate before it expires to prevent connection failures for clients that use encrypted connections.
Enabling SSL encryption increases CPU utilization due to its inherent processing overhead. We recommend that you enable it only when your business requires it.
Enabling or disabling SSL encryption, or updating a certificate, restarts the Controller node and causes a transient connection interruption. Perform these operations during off-peak hours and ensure your application has a reconnection mechanism.

Enable SSL encryption

Log on to the AnalyticDB for MySQL console. In the upper-left corner of the console, select a region. In the left-side navigation pane, click Clusters. Find the cluster that you want to manage and click the cluster ID.
Go to the SSL configuration page.
- For Enterprise Edition, Basic Edition, and Data Lakehouse Edition clusters: In the left-side navigation pane, click Cluster Settings.
- For Data Warehouse Edition clusters: In the left-side navigation pane, click Data Security.
On the SSL Settings tab, turn on the SSL Status switch.
In the Configure SSL dialog box, select the endpoint to protect and click OK.
Important
- AnalyticDB for MySQL lets you encrypt an internal or a public endpoint, but only one endpoint per cluster. After you enable SSL encryption, you can click Configure SSL to change the encrypted endpoint. When you change the endpoint, the certificate is automatically updated and the Controller node is restarted.
- To encrypt the public endpoint, you must first enable a public endpoint for the cluster.
After you enable SSL encryption, click Download Certificate.
The downloaded compressed package contains the following three files:
- A .p7b file: used to import the CA certificate in Windows.
- A .pem file: used to import the CA certificate in other systems or applications.
- A .jks file: a Java TrustStore certificate file. The password is apsaradb. This file is used to import the CA certificate chain in Java applications.
  
  When you use the JKS certificate file in Java, you must modify the default security settings of JDK 7 and JDK 8. On the host where your application runs, modify the following two parameters in the jre/lib/security/java.security file:
```
jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024
```
  If you do not modify the JDK security settings, an error similar to the following one is reported. Such errors are typically caused by Java security settings.
```
javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints
```

Renew an SSL certificate

Log on to the AnalyticDB for MySQL console. In the upper-left corner of the console, select a region. In the left-side navigation pane, click Clusters. Find the cluster that you want to manage and click the cluster ID.
Go to the SSL configuration page.
- For Enterprise Edition, Basic Edition, and Data Lakehouse Edition clusters: In the left-side navigation pane, click Cluster Settings.
- For Data Warehouse Edition clusters: In the left-side navigation pane, click Data Security.
On the SSL Settings tab, click Update Validity.

Disable SSL encryption

Log on to the AnalyticDB for MySQL console. In the upper-left corner of the console, select a region. In the left-side navigation pane, click Clusters. Find the cluster that you want to manage and click the cluster ID.
Go to the SSL configuration page.
- For Enterprise Edition, Basic Edition, and Data Lakehouse Edition clusters: In the left-side navigation pane, click Cluster Settings.
- For Data Warehouse Edition clusters: In the left-side navigation pane, click Data Security.
On the SSL Settings tab, turn off the SSL Status switch.
In the Disable SSL dialog box that appears, click OK.

Related APIs

API	Description
ModifyDBClusterSSL	Enables or disables SSL encryption for a Data Warehouse Edition cluster.
DescribeDBClusterSSL	Queries the SSL configuration of a Data Warehouse Edition cluster.