PolarDB:Configure SSL encryption

Scope of application

Your PolarDB-X 2.0 instance must be version 5.4.10 or later. You can view the instance version on the Basic Information page.

Notes

• An SSL certificate is valid for one year. You must update the validity period and then download and reconfigure the CA certificate before the current one expires. Otherwise, client applications that use encrypted connections will fail to connect.

• Enabling SSL encryption significantly increases CPU utilization. Enable SSL encryption only when required for connections over public endpoints. Connections over private endpoints are generally secure and do not require encryption.

• Enabling or disabling SSL encryption restarts the instance. Perform this operation with caution.

Enable SSL encryption

1. Log on to the PolarDB-X console.

2. In the top navigation bar, select the region where the instance is deployed.

3. On the Instances page, click the PolarDB-X 2.0 tab.

4. Find the instance that you want to manage and click its ID.

5. In the left-side navigation pane, choose Configuration Management > Security Management.

6. Click the SSL Configuration tab, and then turn on the SSL Configuration switch.

   Note

   The SSL-protected Endpoint defaults to the private endpoint. You can change the protected address to the public endpoint. For more information, see Modify the SSL protected address.

7. In the dialog box that appears, click OK.

   Important

   Enabling or disabling SSL encryption restarts the instance. Perform this operation during off-peak hours and ensure your application has an automatic reconnection mechanism.

8. After SSL encryption is enabled, click Download CA Certificate.

   The downloaded file is a compressed package that contains the following three files:

   • A .p7b file: for importing the CA certificate on Windows systems.

   • A .pem file: for importing the CA certificate on other systems or applications.

   • A .jks file: a Java KeyStore (JKS) truststore file for importing the CA certificate chain into Java applications. The password is apsaradb.

     Note

     When you use a JKS certificate file in Java with JDK 7 or JDK 8, you must modify the default security configuration. In the jre/lib/security/java.security file on your application's host, modify the following two parameters:

     jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
     jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

     If you do not modify the security configuration, an error similar to the following may occur. This type of error is typically caused by the Java security configuration.

     javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Configure SSL CA certificate

After you enable SSL encryption, you must configure the SSL CA certificate when your application or client connects to PolarDB-X. This topic uses MySQL Workbench and Navicat as examples to demonstrate how to install the SSL CA certificate. For other applications or clients, refer to their respective documentation.

Configure in MySQL Workbench

1. Start MySQL Workbench.

2. Choose Database > Manage Connections.

3. Select Use SSL and import the SSL CA certificate.

Configure in Navicat

1. Start Navicat.

2. Right-click the target database and choose Edit Connection.

3. Click the SSL tab and specify the path to the .pem CA certificate file.

   Select Use SSL and Use verification, and then click OK.

4. Click OK.

   Note

   If the connection is being used error occurs, a previous session is still active. Close and restart Navicat.

5. Double-click the target database to test the connection.

   If the connection is successful, the databases in your PolarDB-X instance appear in the connection tree on the left. This indicates that the SSL CA certificate is configured correctly.

Update certificate validity

Modify the SSL-protected address

1. Log on to the PolarDB-X console.

2. In the top navigation bar, select the region where the instance is deployed.

3. On the Instances page, click the PolarDB-X 2.0 tab.

4. Find the instance that you want to manage and click its ID.

5. In the left-side navigation pane, choose Configuration Management > Security Management.

6. Click the SSL Configuration tab.

7. Click Configure SSL.

8. In the dialog box that appears, select the endpoint to protect.

   Note

   • When you enable SSL, the SSL-protected Endpoint defaults to the private endpoint. You can change it to the public endpoint.

   • Changing the SSL-protected address restarts the instance. Perform this operation during off-peak hours and ensure that your application has an automatic reconnection mechanism.

   • After you change the SSL-protected address, you must download and reconfigure the CA certificate.

9. Click OK.

Disable SSL encryption

1. Log on to the PolarDB-X console.

2. In the top navigation bar, select the region where the instance is deployed.

3. On the Instances page, click the PolarDB-X 2.0 tab.

4. Find the instance that you want to manage and click its ID.

5. In the left-side navigation pane, choose Configuration Management > Security Management.

6. Click the SSL Configuration tab.

7. Turn off the SSL Configuration switch.

8. In the dialog box that appears, click OK.