ApsaraDB RDS:Configure SSL encryption for a database proxy endpoint

SSL encrypts the network connections at the transport layer between your RDS instance and your application. This enhances the security and integrity of data in transit but increases the response time.

Usage notes

• SSL encryption can be configured for only one dedicated proxy endpoint per proxy terminal.

• If you enable or disable SSL encryption, change the protected database proxy endpoint, or update the validity period of an SSL certificate, your proxy instance restarts. Proceed with caution.

Enable SSL encryption

1. Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the instance ID.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, move the pointer over the ID of the database proxy endpoint. In the SSL Encryption Configuration section of the dialog box that appears, click Enable to the right of SSL Encryption.

4. In the dialog box that appears, select the endpoint that you want to encrypt and click OK.

5. After the SSL encryption status changes to Enabled, click Download CA Certificate next to SSL Encryption.

   Note

   • The file that you downloaded is a package that contains the following files:

     • PEM file: suitable for most scenarios.

     • JKS file: suitable for Java applications. In most cases, the PEM-formatted CA certificate file must be imported to a truststore for conversion into a JKS file. You can use the JKS file in Java applications. The password of the file is apsaradb.

     • P7B file: suitable for a small number of Windows applications that require PKCS#7-formatted certificate files.

   • You can use the configured SSL certificate to verify the certificate for the database server.

   • When you use the .jks file in Java Development Kit (JDK) 7 or JDK 8, go to the jre/lib/security/java.security directory on the host where your application resides and run the following code to modify the default values of two configuration items:

     jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
     jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

     If you do not modify these configurations, the following error is reported. In most cases, other similar errors are also caused by invalid Java security configurations:

     javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Configure an SSL certificate

After you enable SSL encryption and download the CA certificate, you can configure the SSL certificate. For more information, see Download the CA certificate.

Change the protected proxy endpoint

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, move the pointer over the ID of the database proxy endpoint. In the SSL Encryption Configuration section of the dialog box that appears, click Change Protected Endpoint below Protected Endpoint.

4. Select the endpoint that you want to encrypt and click OK.

Update the validity period of the SSL certificate

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, move the pointer over the ID of the database proxy endpoint. In the SSL Encryption Configuration section of the dialog box that appears, click Update Expiration Time to the right of SSL Certificate Expiration Time. In the dialog box that appears, click OK.

Disable SSL encryption

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Proxy.

3. In the Connection Information section, move the pointer over the ID of the database proxy endpoint. In the SSL Encryption Configuration section of the dialog box that appears, click Disable to the right of SSL Encryption. In the dialog box that appears, click OK.

Related operations

References

Sample code for connecting to a database over SSL

For more information, see Application code.

FAQ about SSL encryption

For more information, see FAQ.