ApsaraDB RDS:Configure SSL and enable HTTPS access for RDS Supabase

Prerequisites

Before you begin, ensure that you have:

• An RDS Supabase instance in the Running state. To create one, see Create an RDS Supabase project

• An SSL certificate file and a matching private key file, both bound to the public IP address of the instance:

  • Production environment (recommended): Purchase or request an SSL certificate from a trusted Certificate Authority (CA). Use the RSA 2048-bit encryption algorithm for best compatibility. The certificate file uses a .pem or .crt extension; the private key file uses a .key extension.

  • Test environment: Generate a self-signed certificate using a tool such as mkcert. Self-signed certificates are not trusted by browsers or external clients and must not be used in production.

Before you start

Configuring or updating an SSL certificate triggers an automatic instance restart. This causes a brief service interruption, typically lasting several minutes. Perform this operation during off-peak hours or a scheduled maintenance window.

Step 1: Get the public IP address

1. Log on to the RDS Console. In the left-side navigation pane, click AI App Development Supabase.

2. In the top navigation bar, select a region, then click the instance ID to open the Basic Information page.

3. In the Network Information section, find and record the Outside the network connection address. Use the IP address from this endpoint when generating the certificate.

Step 2: Prepare an SSL certificate (for testing)

The following steps generate a self-signed certificate for the instance's public IP address using mkcert on your local machine.

1. Install mkcert. For example, on macOS using Homebrew:

   brew install mkcert

2. Install a local CA and generate a root certificate. This adds the root certificate to your system's trust store so that certificates you generate are trusted on your local machine.

   mkcert -install

3. Generate a certificate for the public IP address of the instance. Replace <your_public_ip_address> with the actual IP address, excluding the port number.

   mkcert 127.0.0.1 <your_public_ip_address> ::1 localhost my-dev.local

   Example: mkcert 127.0.0.1 47.98.xx.xx ::1 localhost my-dev.local After the command completes, the certificate and private key are saved as ./127.0.0.1+4.pem and ./127.0.0.1+4-key.pem.

Step 3: Configure the SSL certificate

1. Return to the Basic Information page of the instance.

2. In the Network Information section, find SSL Encryption and click SSL Encryption.

3. In the SSL settings dialog box, fill in the following fields:

   Field	Description
   Server certificate	Paste the full contents of your certificate file (for example, 127.0.0.1+4.pem).
   Server certificate private key	Paste the full contents of your private key file (for example, 127.0.0.1+4-key.pem).

4. Verify the information, then click OK.

Step 4: Configure an IP whitelist

Add client IP addresses to the instance's whitelist so they can connect.

1. On the Basic Information page, go to the White list information section.

2. Select a whitelist group and click Modify, or click Create Whitelist.

3. In the White list IP address: field, enter the IP addresses or CIDR blocks to allow. For example, 0.0.0.0/0 allows connections from all IP addresses.

   Warning

   0.0.0.0/0 poses a security risk. Use it in test environments only.

4. Click OK.

Step 5: Verify HTTPS access

1. Wait for the instance status to return to Running.

2. Return to the Basic Information page. In the Network Information section, the Outside the network connection address field now includes a port 443 link starting with https.

3. Click the HTTPS link.

   • If you are using a CA-issued certificate, the browser opens the Supabase welcome page directly.

   • If you are using a self-signed certificate, the browser displays a security warning such as "Your connection is not private". Click Proceed to the address (exact wording varies by browser) to continue.

4. Click the original HTTP link to confirm that access over port 80 is still available.

Billing

• RDS Supabase instance fees: Charged based on instance specifications and subscription duration.

• SSL certificate fees: Enabling SSL on the instance does not incur additional costs. Commercial CA-issued certificates require a separate purchase; self-signed and free certificates are available at no cost.

Risks and mitigations