ApsaraDB RDS:Use a custom certificate to enable SSL encryption

Step 1: Obtain a custom certificate

CentOS is used as an example to describe how to generate a certificate.

1. Create a self-signed certificate and a private key for the self-signed certificate. The self-signed certificate is saved in a file named server-ca.crt. The private key is saved in a file named server-ca.key.

   openssl req -new -x509 -days 365 -nodes -out server-ca.crt -keyout server-ca.key -subj "/CN=root-ca"

2. Create a certificate signing request (CSR) file and a private key for the server certificate. The CSR file is named server.csr. The private key is saved in a file named server.key.

   You can use a custom certificate to protect only one endpoint. You can run the following command to generate the CSR file based on your business requirements:

   openssl req -new -nodes -text -out server.csr -keyout server.key -subj "/CN=rm-bpxxxxx.mysql.rds.aliyuncs.com"

   Note

   Replace rm-bpxxxxx.mysql.rds.aliyuncs.com with the endpoint that you want to protect. For more information about how to view the endpoint, see View and manage instance endpoints and ports.

   When the server.csr file is being created, you are prompted to configure the parameters based on your business requirements. The following table describes the parameters.

   Parameter	Description	Example value
   Country Name	The code of the country. Specify a two-letter country code defined by the International Organization for Standardization (ISO).	CN
   State or Province Name	The province.	ZheJiang
   Locality Name	The city.	HangZhou
   Organization Name	The name of the enterprise.	Alibaba
   Organizational Unit Name	The name of the department.	Aliyun
   Common Name	The domain name that you want to protect by using the certificate. The domain name is specified in the openssl.cnf file. You do not need to configure this parameter.	-
   Email Address	You do not need to configure this parameter.	-
   A challenge password	You do not need to configure this parameter.	-
   An optional company name	You do not need to configure this parameter.	-

3. Create a server certificate. The server certificate is saved in a file named server.crt.

   • If you want to protect an endpoint, run the following command:

     openssl x509 -req -in server.csr -text -days 365 -CA server-ca.crt -CAkey server-ca.key -CAcreateserial  -out server.crt

After the configurations are complete, run the ls command to view the generated files:

# ls
server-ca.crt  server-ca.key  ca.srl  server.crt  server.csr  server.key

The following list describes the files:

• server.crt: the file that contains the server certificate

• server.key: the file that contains the private key of the server certificate

• server-ca.crt: the file that contains the self-signed certificate

• server-ca.key: the file that contains the private key of the self-signed certificate

Step 2: Configure a custom certificate to enable SSL encryption

1. Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region in which your RDS instance resides, find the RDS instance, and then click the instance ID.

2. In the left-side navigation pane of the page that appears, click Data Security. On the page that appears, click the SSL tab.

3. Click Custom Certificate. Then, click the switch next to Disabled. In the dialog box that appears, configure the Server Certificate and Private Key of Server Certificate parameters and click OK.

   Parameter	Description
   Server Certificate	Enter the content of the server.crt file that you created. For more information, see Step 1: Create a custom certificate. Make sure that all the content from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- is copied to this field.
   Private Key of Server Certificate	Enter the content of the server.key file that you created. For more information, see Step 1: Create a custom certificate. Make sure that all the content from -----BEGIN PRIVATE KEY----- to -----END PRIVATE KEY----- is copied to this field.

Step 3: Connect to the RDS instance from a client

You can connect to the RDS instance over SSL. For more information, see Connect to an ApsaraDB RDS for MySQL instance over SSL.

Step 4: (Optional) Update the created custom certificate

If you want to update the custom certificate, click Update SSL on the SSL tab. In the dialog box that appears, configure the Server Certificate and Private Key of Server Certificate parameters.

Step 5: (Optional) Disable SSL encryption

If you want to disable SSL encryption, click the switch next to Enabled on the SSL tab.