Configure SSL encryption in Hologres - Hologres - Alibaba Cloud Documentation Center

To enhance the security of data transfers between your client application and Hologres, you can enable Secure Sockets Layer (SSL) encryption in transit. SSL uses digital certificates and cryptographic protocols such as Transport Layer Security (TLS) to establish an encrypted connection between a Hologres instance and a client. This process protects the confidentiality and integrity of your data in transit.

Scenarios

SSL encryption in transit is suitable for the following scenarios:

Remote database access: When a client needs to access a database from a remote location, SSL encryption in transit secures data in transit.
Meeting compliance requirements: Many industry standards and regulations require data to be encrypted in transit. SSL encryption helps your organization meet these security and compliance requirements.

SSL encrypts network connections at the transport layer, which enhances data security and integrity but also adds network latency.

Prerequisites

A Hologres instance is created. For more information, see Purchase a Hologres instance.
A PSQL client or JDBC is downloaded and installed. For more information, see PSQL client or JDBC.

Usage notes

Hologres V1.1 and later support encryption in transit. Hologres V1.2 and later support TLS. Hologres V2.1 and later support encryption in transit that uses a CA certificate and you can enable the feature on the Hologres console.
Note
If your instance is earlier than V1.1, see Troubleshooting: Upgrade preparation errors or join the Hologres DingTalk group for support. For more information, see How do I get more online support?.
Enabling or disabling SSL encryption in transit restarts the instance, so proceed with caution. This feature is disabled by default.
- After enabling SSL encryption for a Hologres instance, clients can connect to the instance over SSL. You must explicitly configure the client to use an encrypted or unencrypted connection.
- If you disable SSL encryption for a Hologres instance, only non-SSL connections are allowed.

Hologres supports the following SSL modes for encryption in transit:

SSL mode	Minimum supported version
Require: Encrypts only the data link.	V1.1
Verify-CA: Encrypts the data link and uses a CA certificate to verify the authenticity of the Hologres server.	V2.1
Verify-Full: Encrypts the data link, uses a CA certificate to verify the authenticity of the Hologres server, and verifies that the CN or DNS in the certificate matches the Hologres connection address that is configured for the connection.	V2.1

The SSL certificate is valid for one year. You must manually renew the certificate before it expires. Otherwise, you can no longer use SSL encryption to connect to the instance.
Enabling SSL encryption in transit increases CPU consumption and read/write latency.
After enabling SSL encryption in transit, you must disconnect and reconnect existing connections for the encryption to take effect.
Enabling or disabling SSL encryption in transit, and renewing the SSL certificate, restarts your Hologres instance. The process takes about 3 minutes. Perform these operations during off-peak hours.

Step 1: Enable encryption in transit

Log on to the Hologres console and select a region in the upper-left corner.
In the left-side navigation pane, click Instances and then click the ID of the target instance.
On the instance details page, click Data Security.
On the SSL tab, turn on the SSL Encryption switch.
In the Enable SSL Encryption dialog box, click Enable SSL Encryption.

Step 2: Download the CA certificate

Hologres provides a CA certificate for your instance. Use this CA certificate on your remote client to verify the instance's authenticity.

Log on to the Hologres console and select a region in the upper-left corner.
In the left-side navigation pane, click Instances and then click the ID of the target instance.
On the instance details page, click Data Security.
On the SSL tab, click Download Certificate.

Step 3: Connect to Hologres

You can connect to Hologres using a PSQL client or JDBC. During the connection process, you can configure parameters to control whether to enable SSL encryption in transit.

PSQL client

Connection command

PG_USER=<AccessKey ID> 
PG_PASSWORD=<AccessKey Secret> 
PG_SSLMODE=<SSL Mode> 
PG_SSLROOTCERT=<certificate folder> 
PGSSLMODE=$PG_SSLMODE PGSSLROOTCERT=$PG_SSLROOTCERT PGUSER=$PG_USER PGPASSWORD=$PG_PASSWORD psql -p <Port> -h <Endpoint> -d <Database>

Parameters

Parameter	Description
AccessKey ID	The AccessKey ID of your Alibaba Cloud account.Get it from AccessKey. We recommend using environment variables for credentials to reduce the risk of exposure.
AccessKey Secret	The AccessKey Secret of your Alibaba Cloud account. Get it from AccessKey. We recommend using environment variables for credentials to reduce the risk of exposure.
SSL Mode	Specifies the SSL mode for the PSQL connection. Valid values: require: uses encryption in transit and encrypts only the data link. verify-ca: encrypts the data link and verifies the authenticity of the Hologres instance. verify-full: encrypts the data link, verifies the authenticity of the Hologres instance, and verifies that the CN or DNS in the certificate matches the database connection address configured for the connection. disable: does not use encryption in transit.
certificate folder	The storage path of the CA certificate. This parameter is required if the `SSL Mode` parameter is set to verify-ca or verify-full.
port	The public port of the Hologres instance. Example: `80`.
endpoint	The public endpoint of the Hologres instance. Example: `xxx-cn-hangzhou.hologres.aliyuncs.com`.
database	The name of the Hologres database. After creating a Hologres instance, a default database named postgres is automatically created. You can use the postgres database to connect to Hologres, but this database has limited resources. For production use, we recommend that you create a new database. For more information, see Create a database. Example: `mydb`.

Verify the connection.

If you set PGSSLMODE to require, the following output indicates that the connection to Hologres uses SSL encryption.

PGUSER=$PG_USER PGPASSWORD=$PG_PASSWORD PGSSLMODE=require psql -h $HOST_NAME -p $PORT -d $DB -E
psql (14.2, server 11.3)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.

JDBC

When you use JDBC to connect to Hologres, you can use the ssl and sslmode connection parameters to control whether to use SSL encryption. The resulting connection behavior is described in the following table.

SSL enabled on instance	ssl	sslmode	Result
Yes	true	require verify-ca verify-full	The connection is successful and data is encrypted in transit.
Yes	false	require verify-ca verify-full	The connection is successful, but data is not encrypted in transit.
No	true	require verify-ca verify-full	An error is reported. Example: /Users/timothyding/Library/Java/JavaVirtualMachines/corretto-1.8.0_322/Contents/Home/bin/java ... org.postgresql.util.PSQLException Create breakpoint : The server does not support SSL. at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:524) at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:149) at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213) at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51) at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:225) at org.postgresql.Driver.makeConnection(Driver.java:465) at org.postgresql.Driver.connect(Driver.java:264) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at rds_ssl_test.main(rds_ssl_test.java:34)
No	false	require verify-ca verify-full	The connection is successful, but data is not encrypted in transit.

The following code provides an example.

 // Set the endpoint of the Hologres instance.
 String hostname = "hgxxxxxxx-cn-hangzhou-vpc.hologres.aliyuncs.com:80";
 // Set the port of the Hologres instance.
 String port = "80";
 // Set the name of the database to connect to.
 String dbname = "postgres";
 String jdbcUrl = "jdbc:postgresql://" + hostname + ":" + port + "/" + dbname+"?binaryTransfer=true";
 Properties properties = new Properties();
 // Set the database username. Using an environment variable is recommended.
 properties.setProperty("user", "accessid");
 // Set the database password. Using an environment variable is recommended.
 properties.setProperty("password", "accesskey");
  // Configure the connection to use SSL.
  properties.setProperty("ssl", "true");
  // Specify the file path of the root certificate.
  properties.setProperty("sslrootcert", path + "/" + "hologres_certificate.crt");
  // Set the SSL mode. Valid values are require, verify-ca, and verify-full.
  properties.setProperty("sslmode", "verify-full");
  try {
      Class.forName("org.postgresql.Driver");
      Connection connection = DriverManager.getConnection(jdbcUrl, properties);
      // The following code queries the 'example' table, which is assumed to exist.
      PreparedStatement preparedStatement = connection.prepareStatement("select * from " +
              "example");
      ResultSet resultSet = preparedStatement.executeQuery();
      while (resultSet.next()) {
          ResultSetMetaData rsmd = resultSet.getMetaData();
          int columnCount = rsmd.getColumnCount();
          Map map = new HashMap();
          for (int i = 0; i < columnCount; i++) {
              map.put(rsmd.getColumnName(i + 1).toLowerCase(), resultSet.getObject(i + 1));
          }
          System.out.println(map);
      }
  } catch (Exception exception) {
      exception.printStackTrace();
  }