AnalyticDB:SSL encryption

Prerequisites

Before you begin, ensure that you have:

• An AnalyticDB for MySQL cluster running kernel version 3.2.1.0 or later

To check or update the kernel version, go to the Configuration Information section of the Cluster Information page in the AnalyticDB for MySQL console. For instructions, see Update the minor version of a cluster.

Usage notes

• Certificate expiry: SSL certificates are valid for one year. Renew the certificate before it expires — expired certificates cause client connections to fail.

• Performance impact: SSL encryption increases CPU utilization. Enable it only when connection security is a requirement.

• Controller node restart: Enabling SSL, disabling SSL, or updating a certificate restarts the Controller node and causes transient connection errors. Perform these operations during off-peak hours and make sure your application has a reconnection mechanism.

• One endpoint per cluster: You can encrypt either the internal endpoint or the public endpoint, but not both simultaneously.

Enable SSL encryption

1. Log on to the AnalyticDB for MySQL console. In the upper-left corner, select a region. In the left-side navigation pane, click Clusters, then click the cluster ID.

2. Navigate to the SSL configuration page based on your edition:

   Edition	Navigation path
   Enterprise Edition, Basic Edition, Data Lakehouse Edition	Left pane → Cluster Settings
   Data Warehouse Edition	Left pane → Data Security

3. On the SSL Settings tab, turn on the SSL Status switch.

4. In the Configure SSL Encryption dialog box, select the endpoint to protect — internal or public — then click OK.

   Important

   To encrypt a public endpoint, first enable a public endpoint for the cluster. After SSL is enabled, click Configure SSL Encryption again to change the encrypted endpoint. Changing the endpoint automatically updates the certificate and restarts the Controller node.

5. Click Download Certificate.

The downloaded compressed package contains three certificate files:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Update the validity period of an SSL certificate

Renew the certificate before it expires to prevent connection failures.

1. Log on to the AnalyticDB for MySQL console. Select a region, click Clusters, then click the cluster ID.

2. Navigate to the SSL configuration page:

   Edition	Navigation path
   Enterprise Edition, Basic Edition, Data Lakehouse Edition	Left pane → Cluster Settings
   Data Warehouse Edition	Left pane → Data Security

3. On the SSL Settings tab, click Update Validity Period.

Disable SSL encryption

1. Log on to the AnalyticDB for MySQL console. Select a region, click Clusters, then click the cluster ID.

2. Navigate to the SSL configuration page:

   Edition	Navigation path
   Enterprise Edition, Basic Edition, Data Lakehouse Edition	Left pane → Cluster Settings
   Data Warehouse Edition	Left pane → Data Security

3. On the SSL Settings tab, turn off the SSL Status switch.

4. In the Disable SSL Encryption dialog box, click OK.

API reference