When you configure ssl encryption for an ApsaraDB RDS for MySQL instance, you can use either a cloud certificate provided by ApsaraDB or a custom certificate. This topic describes how to enable ssl encryption with a custom certificate.
Prerequisites
OpenSSL is installed.
The ssl encryption feature is available only on ApsaraDB RDS for MySQL instances with the following editions and versions:
High-availability Edition: 8.4, 8.0, 5.7, and 5.6
Cluster Edition: 8.4, 8.0, and 5.7
Basic Edition: 8.4, 8.0, and 5.7
The forceful ssl encryption feature is available only for instances that meet the following requirements:
Major engine version: 8.4, 8.0, or 5.7
Product edition: Basic Edition, High-availability Edition, or Cluster Edition
The minor engine version is 20241130 or later.
On Linux systems, OpenSSL is typically pre-installed.
On Windows systems, you must download and install the OpenSSL package.
Usage notes
Enabling ssl encryption increases cpu utilization and read and write latency.
After enabling ssl encryption, you must re-establish existing connections for the encryption to take effect.
Configuring or modifying a custom certificate, or disabling ssl encryption, restarts your database instance. The restart takes about three minutes. We recommend that you perform this operation during off-peak hours.
If you enable forceful ssl encryption, clients and the database proxy can connect to the ApsaraDB RDS for MySQL instance only by using SSL encryption. Non-encrypted connections are rejected.
Procedure
Step 1: Obtain a custom certificate
When you generate the server private key or the private key of the self-signed certificate, do not encrypt it with a password. Otherwise, you cannot enable ssl encryption.
The following steps use CentOS as an example.
If your operating system is Windows, the openssl command is configured in the same way as the openssl command on CentOS systems. Replace the cp command with manual copying, and the vim command with manual file editing.
Create a self-signed CA certificate (server-ca.crt) and its private key (server-ca.key).
openssl req -new -x509 -days 365 -nodes -out server-ca.crt -keyout server-ca.key -subj "/CN=root-ca"Generate a server certificate signing request (CSR) (server.csr) and a server private key (server.key).
A custom certificate for an ApsaraDB RDS for MySQL instance currently protects only one endpoint. Generate the CSR for your endpoint by running the following command:
openssl req -new -nodes -text -out server.csr -keyout server.key -subj "/CN=rm-bpxxxxx.mysql.rds.aliyuncs.com"NoteThe endpoint
rm-bpxxxxx.mysql.rds.aliyuncs.comis an example. Replace it with the endpoint that you want to protect. To view the endpoint of your instance, see View and manage instance endpoints and ports.When you generate the CSR file (server.csr), you are prompted to set the following parameters.
Parameter
Description
Example
Country name
The two-letter ISO country code.
CN
State or province name
The name of the province.
Zhejiang
Locality name
The name of the city.
Hangzhou
Organization name
The name of the company.
Alibaba
Organizational unit name
The name of the department.
Aliyun
Common name
The domain name for which you request the SSL certificate. This is configured in the openssl.cnf file and no input is required.
-
Email address
Leave this field blank.
-
A challenge password
Leave this field blank.
-
An optional company name
Leave this field blank.
-
Generate the server certificate (server.crt).
To protect the endpoint, run the following command.
openssl x509 -req -in server.csr -text -days 365 -CA server-ca.crt -CAkey server-ca.key -CAcreateserial -out server.crt
After you complete these steps, run the ls command to view the generated files:
# ls
server-ca.crt server-ca.key ca.srl server.crt server.csr server.keyThe generated key files are:
server.crt: The server certificate file.
server.key: The server private key file.
server-ca.crt: The self-signed CA certificate.
server-ca.key: The private key of the self-signed CA certificate.
Step 2: Enable SSL with a custom certificate
After configuring the custom certificate, the status of the instance changes to Modifying SSL Settings for about three minutes. Wait until the instance status changes to running before proceeding.
Go to the RDS Instances list. In the top navigation bar, select the region of your target instance, and then click the instance ID.
In the left-side navigation pane, choose .
For Custom Certificate, select Use custom certificate. Click the switch next to Disabled to enable SSL. Enter the content for Server Certificate and Private Key of Server Certificate. Choose whether to enable Forceful Encryption, and then click OK.
Parameter
Value
Server certificate
Paste the content of the server.crt file that you obtained in Step 1: Obtain a custom certificate. The content must include everything from the -----BEGIN CERTIFICATE----- line to the -----END CERTIFICATE----- line.
Server private key
Paste the content of the server.key file that you obtained in Step 1: Obtain a custom certificate. The content must include everything from the -----BEGIN PRIVATE KEY----- line to the -----END PRIVATE KEY----- line.
Forceful ssl encryption
Enable or disable this feature based on your business requirements.
This feature is available for instances that run MySQL 8.4, 8.0, or 5.7 with a minor engine version of 20241130 or later.
If you enable forceful ssl encryption, clients and the database proxy can connect to the ApsaraDB RDS for MySQL instance only by using SSL encryption. Non-encrypted connections are rejected.
Step 3: Connect to the database
You can remotely connect to the ApsaraDB RDS for MySQL instance over SSL. For more information, see Connect to an ApsaraDB RDS for MySQL instance over SSL.
Step 4: (Optional) Update the certificate
Updating the certificate restarts the instance for all MySQL versions except MySQL 8.0. Proceed with caution.
To update the certificate, click Update SSL on the SSL page and then enter the new server certificate and server private key.
Step 5: (Optional) Disable ssl encryption
Disabling ssl encryption restarts the instance. Proceed with caution.
To disable ssl encryption, click the switch next to Enabled on the SSL page.
FAQ
Q: What do I do if my custom certificate expires?
A: You define the validity period of your custom certificate. The system notifies you before the certificate expires. Update the certificate promptly after receiving the notification to avoid disrupting your workloads.