PolarDB:Configure SSL encryption

Step 1: Enable SSL encryption

1. Log in to the PolarDB console. In the left-side navigation pane, click Clusters. Select the region where your cluster is located, and then click the cluster ID.

2. In the left-side navigation pane, choose Settings and Management > Security.

3. On the SSL Settings tab, turn on the SSL Status switch to enable SSL encryption.

   Note

   You can configure SSL for primary, cluster, and custom endpoints.

4. In the Configure SSL dialog box, select the endpoint to encrypt, and then click OK.

Step 2: Download the certificate

After you enable SSL encryption, you can download the certificate for the PolarDB cluster to verify the authenticity of the database when a client remotely connects to the PolarDB cluster.

1. On the SSL Settings tab, click Download in the section for the desired endpoint.

2. The downloaded file is a compressed package that contains the following three files:

   • .p7b file: For importing the CA certificate in Windows.

   • .pem file: For importing the CA certificate in other systems or applications.

   • .jks file: A Java truststore certificate file, with the password apsaradb, for importing the CA certificate chain into Java applications.

     Note

     When using the JKS certificate file in Java, you must modify the default security configuration for JDK 7 and JDK 8. On the server that connects to the PolarDB database, edit the jre/lib/security/java.security file and modify the following two settings:

     jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
     jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

     If you do not modify the JDK security settings, an error similar to the following may occur. This and other related errors are typically caused by incorrect Java security settings.

     javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Step 3: Connect to PolarDB from a client

After you enable SSL encryption, whether a connection between a client and the PolarDB cluster is encrypted depends on the client's type and settings. For example, some clients might use encrypted connections by default. You can modify the client's settings or code to establish an encrypted connection and verify the PolarDB cluster's identity.

mysql -h {endpoint} -u {username} -p --ssl-mode=PREFERRED

mysql -h {endpoint} -u {username} -p --ssl-mode=VERIFY_CA --ssl-ca={CA certificate path}/ApsaraDB-CA-Chain.pem

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

package com.example.ssltest;
import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
public class Main {
    public static void main(String[] args) {
       Connection conn = null;
        MysqlDataSource mysqlDS=null;
        try{
            mysqlDS = new MysqlDataSource();
            // Set SslMode as needed. For options, see the command-line connection instructions.
            mysqlDS.setSslMode("VERIFY_IDENTITY");
            // The truststore contains the CA certificate. Set the truststore type to JKS.
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            // Replace the path after file:/ with the path to your ApsaraDB-CA-Chain.jks file.
            mysqlDS.setTrustCertificateKeyStoreUrl("file://{CA certificate path}/ApsaraDB-CA-Chain.jks");
            // The password for the downloaded JKS file is apsaradb and cannot be changed.
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");
            // Your database endpoint
            mysqlDS.setServerName("your_polardb_host");
            // Your database port
            mysqlDS.setPort(3306);
            // Your database username
            mysqlDS.setUser("your_username");
            // Your database password
            mysqlDS.setPassword("your_password");
            // Your database name
            mysqlDS.setDatabaseName("your_database");
            System.out.println("Attempting to connect to the database...");
            conn = mysqlDS.getConnection();
            System.out.println("Database connection successful!");
            // Use try-with-resources to ensure Statement and ResultSet are automatically closed.
            try (Statement stmt = conn.createStatement();
                 ResultSet rs = stmt.executeQuery("SELECT VERSION()")) {
                // Check if the query returned a result.
                if (rs.next()) {
                    // Get the result from the first column and print it.
                    String dbVersion = rs.getString(1);
                    System.out.println("Database version: " + dbVersion);
                } else {
                    System.out.println("Failed to retrieve database version information.");
                }
            }
        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }
}

# Install pymysql
# pip install pymysql
import pymysql
# --- Configure your database information ---
db_config = {
    'host': 'your_polardb_host',          # Your cluster endpoint
    'user': 'your_username',            # Your username
    'password': 'your_password',        # Your password
    'database': 'your_database',        # The database you want to connect to
    'port': 3306
}
# --- Configure SSL information ---
ssl_args = {
    'ca': '{CA certificate path}/ApsaraDB-CA-Chain.pem',
    'mode': 'VERIFY_CA'
}
try:
    # Establish a connection, passing ssl parameters
    print("Attempting to connect to MySQL with SSL...")
    connection = pymysql.connect(**db_config, ssl=ssl_args)
    print("SSL connection successful!")
    with connection.cursor() as cursor:
        # Execute a simple query to verify the connection
        cursor.execute("SELECT VERSION()")
        version = cursor.fetchone()
        print(f"Database version: {version[0]}")
except pymysql.MySQLError as e:
    # Printing SSL-related errors can be helpful for troubleshooting
    print(f"Connection failed: {e}")
finally:
    if 'connection' in locals() and connection.open:
        connection.close()
        print("Database connection closed.")

Step 4: Verify encrypted connection

The SSL protocol has multiple versions. PolarDB currently supports TLSv1.2 and later. During the SSL handshake, the client and the PolarDB server negotiate connection parameters, including the TLS version, cipher suite, and session key. For a detailed list of cipher suites, visit the OpenSSL official website.

1. Connect to the PolarDB cluster by using a client that is configured for SSL.

2. Execute the following SQL query:

   SHOW STATUS LIKE 'ssl_cipher';
   +---------------+---------------------------+
   | Variable_name | Value                     |
   +---------------+---------------------------+
   | Ssl_cipher    | DHE-RSA-AES256-GCM-SHA384 |
   +---------------+---------------------------+

3. Analyze the result:

   • If the Value column returns a non-empty value, such as DHE-RSA-AES256-GCM-SHA384, the current connection is encrypted.

   • If the Value column is empty, the current connection is not encrypted. Check your client configuration.

Modify the protected endpoint

To change the endpoint protected by SSL, click Configure SSL in the section for that endpoint.

Update the certificate validity period

If you change the SSL endpoint or the certificate is about to expire, you must manually update the certificate's validity period.

1. On the SSL Settings tab, click Update Validity Period.

2. In the dialog box that appears, click OK.

3. After the validity period is updated, download and configure the new certificate.

Enable automatic certificate rotation

If you enable automatic certificate rotation, PolarDB automatically renews the certificate during the cluster's maintenance window within 10 days of its expiration.

1. On the SSL Settings tab, click Advanced Settings.

2. In the Advanced Settings dialog box, enable automatic certificate rotation and click Confirm.

Disable SSL encryption

1. On the SSL Settings tab, turn off the SSL Status switch to disable SSL encryption.

2. In the dialog box that appears, click OK.