ApsaraDB RDS:Configure SSL encryption for a database proxy

SSL encrypts network connections at the transport layer, which secures data in transit and ensures its integrity. However, it can also slightly increase connection response time.

Usage notes

• SSL encryption can be enabled for only one database proxy endpoint per proxy terminal.

• Enabling or disabling SSL encryption, changing the encrypted endpoint, or updating the certificate validity period will restart the proxy instance. Proceed with caution.

Enable SSL encryption

1. Go to the RDS instances page, select a region at the top, and then click the ID of the target instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, hover over the target database proxy endpoint ID. In the dialog box that appears, go to the SSL Encryption Configuration section and click Activate next to SSL Encryption.

4. In the dialog box that appears, select the endpoint that you want to encrypt and click OK.

5. After the SSL status changes to On, click Download CA Certificate next to SSL Encryption.

   Note

   • The downloaded file is a compressed archive that contains the following three files:

     • PEM file: Suitable for most use cases.

     • JKS file: Typically, Java applications require you to import a PEM certificate into a JKS truststore. You can directly use this JKS file in your Java application. The password is apsaradb.

     • P7B file: Suitable for some Windows applications that require a PKCS #7 certificate file.

   • After you configure the SSL CA certificate, you can verify the database server certificate.

   • If you use the JKS certificate file in Java Development Kit (JDK) 7 or 8, you must modify the default security settings. On your application host, open the jre/lib/security/java.security file and modify the following two parameters:

     jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
     jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

     If you do not modify the security configuration, you might receive an error similar to the following. Similar errors are often caused by the Java security configuration.

     javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Configure a CA certificate

After you enable SSL encryption and download the CA certificate, you can configure the CA certificate. For more information, see Configure a CA certificate.

Change the SSL-encrypted endpoint

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, hover over the target database proxy endpoint ID. In the dialog box that appears, go to the SSL Encryption Configuration section and click Change Protected Endpoint below Protected Endpoint.

4. Select the endpoint that you want to encrypt and click OK.

Update certificate validity

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, hover over the target database proxy endpoint ID. In the dialog box that appears, go to the SSL Encryption Configuration section and click Update Expiration Time next to SSL Encryption. Click OK in the subsequent confirmation dialog box.

Disable SSL encryption

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, hover over the target database proxy endpoint ID. In the dialog box that appears, go to the SSL Encryption Configuration section and click Close next to SSL Encryption. Click OK in the subsequent confirmation dialog box.

API reference

Appendix

SSL connection sample code

For more information, see Sample code for connecting to a database over SSL.

SSL encryption FAQ

For more information, see FAQ about SSL encryption.