PolarDB:Configure SSL encryption

Command line

For MySQL clients version 5.7.11 and later, add the --ssl-mode option to configure SSL encryption:

Attempt an encrypted connection with fallback:

mysql -h {endpoint} -u {username} -p --ssl-mode=PREFERRED

Require an encrypted connection with CA verification:

mysql -h {endpoint} -u {username} -p --ssl-mode=VERIFY_CA --ssl-ca={path_to_CA_certificate}/ApsaraDB-CA-Chain.pem

MySQL Workbench

1. Open MySQL Workbench and choose Database > Manage Connections.

2. Enter the PolarDB endpoint, username, and password.

3. On the SSL tab, set the Use SSL parameter. For the SSL CA File parameter, specify the path to the downloaded PEM-format CA certificate. Then, click Test Connection or OK.

Java

This example uses Connector/J (mysql-connector-java), the official MySQL JDBC driver. Add the following Maven dependency:

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

package com.example.ssltest;

import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class Main {
    public static void main(String[] args) {
       Connection conn = null;
        MysqlDataSource mysqlDS=null;

        try{
            mysqlDS = new MysqlDataSource();
            // Set SslMode as needed. For more information about the options for this property, see the command-line connection method.
            mysqlDS.setSslMode("VERIFY_IDENTITY");

            // The truststore is used to store the CA certificate. Set the truststore type to JKS.
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            // Replace the path after file:/ with the path to your ApsaraDB-CA-Chain.jks file.
            mysqlDS.setTrustCertificateKeyStoreUrl("file://{path_to_CA_certificate}/ApsaraDB-CA-Chain.jks");
            // The password for the downloaded JKS file is apsaradb and cannot be changed.
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");

            // Your database endpoint
            mysqlDS.setServerName("your_polardb_host");
            // Your database port
            mysqlDS.setPort(3306);
            // Your database username
            mysqlDS.setUser("your_username");
            // Your database password
            mysqlDS.setPassword("your_password");
            // Your database name
            mysqlDS.setDatabaseName("your_database");

            System.out.println("Attempting to connect to the database...");
            conn = mysqlDS.getConnection();
            System.out.println("Database connection successful!");

            // Use try-with-resources to ensure that Statement and ResultSet are automatically closed
            try (Statement stmt = conn.createStatement();
                 ResultSet rs = stmt.executeQuery("SELECT VERSION()")) {

                // Check if the query returned a result
                if (rs.next()) {
                    // Get the result from the first column and print it
                    String dbVersion = rs.getString(1);
                    System.out.println("Database version: " + dbVersion);
                } else {
                    System.out.println("Failed to retrieve database version information.");
                }
            }

        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }
}

Python

# Install pymysql
# pip install pymysql

import pymysql

# --- Configure your database information ---
db_config = {
    'host': 'your_polardb_host',          # Your cluster endpoint
    'user': 'your_username',            # Your username
    'password': 'your_password',        # Your password
    'database': 'your_database',        # The database you want to connect to
    'port': 3306
}

# --- Configure SSL information ---
ssl_args = {
    'ca': '{path_to_CA_certificate}/ApsaraDB-CA-Chain.pem',
    'mode': 'VERIFY_CA'
}

try:
    # Establish a connection and pass the ssl parameter
    print("Attempting to connect to MySQL using SSL...")
    connection = pymysql.connect(**db_config, ssl=ssl_args)
    print("SSL connection successful!")

    with connection.cursor() as cursor:
        # Execute a simple query to verify the connection
        cursor.execute("SELECT VERSION()")
        version = cursor.fetchone()
        print(f"Database version: {version[0]}")

except pymysql.MySQLError as e:
    # Printing SSL-related errors can be helpful
    print(f"Connection failed: {e}")
finally:
    if 'connection' in locals() and connection.open:
        connection.close()
        print("Database connection closed.")