ApsaraDB RDS:Enable SSL with a cloud certificate

Impacts

• Enabling or disabling SSL encryption restarts the instance for all versions, which triggers a primary/secondary switchover. We recommend that you perform this operation during off-peak hours and ensure that your application has an automatic reconnection mechanism. For more information about the impacts of an instance switchover, see Impacts of a switchover.

• When you update the certificate, instances that run MySQL 5.6, 5.7, or 8.4 are restarted. Instances that run MySQL 8.0 are not restarted.

• After you enable SSL encryption, using encrypted connections significantly increases CPU utilization. We recommend that you enable SSL encryption only when you require encryption for a public endpoint. Internal endpoints are relatively secure and typically do not require encryption.

• After you enable forced SSL encryption, only SSL-encrypted connections from clients or database proxies are allowed. Non-encrypted connections are rejected.

TLS versions

Transport Layer Security (TLS) is a widely used protocol that ensures the privacy and data integrity of internet communications. The TLS protocol has multiple versions. The following table describes the TLS versions supported by different major versions of ApsaraDB RDS for MySQL.

Default ssl_cipher configuration

ApsaraDB RDS for MySQL uses OpenSSL to implement secure TLS communication. In minor engine version 20230831 for MySQL 5.7 and minor engine version 20230930 for MySQL 8.0, ApsaraDB RDS for MySQL was upgraded to OpenSSL 3.0. By default, OpenSSL 3.0 does not support communication using TLS 1.0 or TLS 1.1. For more information, see the official OpenSSL documentation.

For compatibility, ApsaraDB RDS for MySQL adjusts the default value of the ssl_cipher parameter to "ALL:@SECLEVEL=0" to restore support for TLS 1.0 and TLS 1.1.

If your workloads use only TLS 1.2 or later, we recommend that you set the ssl_cipher parameter to "" (an empty string) in the ApsaraDB RDS console to achieve a higher level of security.

Step 1: Enable SSL encryption

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Data Security.

3. On the SSL Encryption tab, click the switch next to Disabled.

   Note

   If the SSL tab does not appear, check that your instance meets the requirements in the Prerequisites section.

4. In the dialog box that appears, select the endpoint for which you want to enable SSL encryption.

   You can encrypt either the internal endpoint or the public endpoint, but you can select only one endpoint.

5. (Optional) To enable forced SSL encryption, click the switch next to Forceful Encryption.

   Important

   • To enable forced SSL encryption, the instance must run MySQL 8.4, or MySQL 8.0 or 5.7 with a minor engine version of 20241130 or later.

   • After you enable forced SSL encryption, only SSL-encrypted connections from clients or database proxies are allowed. Non-encrypted connections are rejected.

6. Click OK to enable SSL encryption.

   The process takes about one minute. You can manually refresh the page to view the instance status.

Step 2: Download the CA certificate

After you enable SSL encryption, you can download the CA certificate for the ApsaraDB RDS for MySQL instance. Clients use this certificate to verify the authenticity of the RDS instance.

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Data Security. On the SSL tab, click Download CA Certificate.

   The downloaded file is a compressed package that contains the following three CA files:

   • PEM file: suitable for most scenarios.

   • JKS file: suitable for Java applications. The password is apsaradb. A CA certificate in PEM format must typically be imported into a truststore, which means it must be converted to a JKS file before it can be used in Java.

   • p7b file: suitable for a few Windows applications that require PKCS #7 certificate files.

Step 3: Connect from a client

After you enable SSL encryption, whether a client connection is encrypted depends on the client's type and settings. For example, some clients may use encrypted connections by default. You can change the client settings or code to ensure that encrypted connections are established and the identity of the ApsaraDB RDS for MySQL instance is verified.

mysql -h {RDS_ENDPOINT} -u {RDS_ACCOUNT} -p --ssl-mode=PREFERRED

mysql -h {RDS_ENDPOINT} -u {RDS_ACCOUNT} -p --ssl-mode=VERIFY_CA --ssl-ca={CA_CERTIFICATE_PATH}/ApsaraDB-CA-Chain.pem

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

package com.aliyun.sample;

import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.SQLException;

public class Sample {

    public static void main(String[] args) {

        Connection conn = null;
        MysqlDataSource mysqlDS=null;

        try{
            mysqlDS = new MysqlDataSource();
            // Set sslMode as needed. For options, see the CLI section.
            mysqlDS.setSslMode("VERIFY_IDENTITY");
          
            // The truststore stores the CA certificate. This example uses JKS format.
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            // Replace the path after file:/ with the path to your ApsaraDB-CA-Chain.jks file.
            mysqlDS.setTrustCertificateKeyStoreUrl("file:/D:\\ApsaraDB-CA-Chain\\ApsaraDB-CA-Chain.jks");
            // The password for the downloaded JKS file is apsaradb and cannot be changed.
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");
          
            // Your database endpoint
            mysqlDS.setServerName("rm-xxxxxx.mysql.rds.aliyuncs.com");
            // Your database port
            mysqlDS.setPort(3306);
            // Your database account
            mysqlDS.setUser("xxxxxx");
            // Your database password
            mysqlDS.setPassword("xxxxxx");
            // Your database name
            mysqlDS.setDatabaseName("xxxxxx");

            conn = mysqlDS.getConnection();

        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }

}

# Install pymysql: pip install pymysql

import pymysql

try:
    # ca: The path to the CA certificate file. mode: The SSL mode to use.
    ssl_config = {"ca":"/path/to/path/ca.crt", "mode":"VERIFY_CA"}
    conn = pymysql.connect(host='******.mysql.rds.aliyuncs.com', user='*****', passwd='******', db='*****', ssl=ssl_config)
    cursor = conn.cursor()
    cursor.execute('select version()')
    data = cursor.fetchone()
    print('Database version:', data[0])
    cursor.close()
except pymysql.Error as e:
    print(e)

FAQ

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

Related APIs

• View RDS instance SSL configuration

• Modify RDS instance SSL configuration