ApsaraDB RDS:Connect to an ApsaraDB RDS for MySQL instance over SSL

Java

MySQL Connector/J (mysql-connector-java) is the official JDBC driver for MySQL. In this example, mysql-connector-java 8.0.19 is used as the dependency.

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

Sample code:

package com.aliyun.sample;

import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.SQLException;

public class Sample {

    public static void main(String[] args) {

        Connection conn = null;
        MysqlDataSource mysqlDS=null;

        try{
            mysqlDS = new MysqlDataSource();
            //You can specify the sslMode property based on your business requirements. For more information about the options for this property, see the description in the "CLI" section of this topic. 
            mysqlDS.setSslMode("VERIFY_IDENTITY");
          
            //The truststore is used to store the CA certificate. In this example, the truststore type is set to JKS. 
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            //You must replace the content following file:/ with the actual path to your ApsaraDB-CA-Chain.jks file. 
            mysqlDS.setTrustCertificateKeyStoreUrl("file:/D:\\ApsaraDB-CA-Chain\\ApsaraDB-CA-Chain.jks");
            //The password of the downloaded JKS file is fixed as apsaradb. 
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");
          
            //The endpoint of your RDS instance.
            mysqlDS.setServerName("rm-xxxxxx.mysql.rds.aliyuncs.com");
            //The port number of your RDS instance.
            mysqlDS.setPort(3306);
            //The username of the account that is used to connect to your RDS instance.
            mysqlDS.setUser("xxxxxx");
            //The password of the account that is used to connect to your RDS instance.
            mysqlDS.setPassword("xxxxxx");
            //The name of the database that you want to connect on your RDS instance.
            mysqlDS.setDatabaseName("xxxxxx");

            conn = mysqlDS.getConnection();

        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }

}

Python

# Run the pip install pymysql command to install PyMySQL.

import pymysql

try:
    ssl_config = {"ca":"/path/to/path/ca.crt", "mode":"VERIFY_CA"} # You must set ca to the path to the certificate and mode to the SSL mode that you use.
    conn = pymysql.connect(host='******.mysql.rds.aliyuncs.com', user='*****', passwd='******', db='*****', ssl=ssl_config)
    cursor = conn.cursor()
    cursor.execute('select version()')
    data = cursor.fetchone()
    print('Database version:', data[0])
    cursor.close()
except pymysql.Error as e:
    print(e)

Java

MySQL Connector/J (mysql-connector-java) is the official JDBC driver for MySQL. In this example, mysql-connector-java 8.0.19 is used as the dependency.

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.19</version>
</dependency>

1. Use OpenSSL to convert your client certificate and private key to PKCS#12 files. The keytool utility does not support a PEM-formatted private key or certificate.

   openssl pkcs12 -export -in {Custom CA certificate} -inkey {Private key of the custom CA certificate} -out keystore.p12 -name ganyang -CAfile {Custom CA certificate}
   # Enter the password that is used to connect to the RDS instance.
   Enter Encryption Password:
   Verifying - Enter Encryption Password:

2. Use keytool to import the newly created PKCS#12 files into a new JKS file:

   keytool -importkeystore -deststorepass JKS-password -destkeypass key-password -destkeystore keystore.jks -deststoretype pkcs12 -srckeystore keystore.p12 -srcstoretype pkcs12 -srcstorepass P12-password -alias your-alias

   Parameter description:

   -deststorepass: the password specified for the JKS file. 
   -destkeypass: the password specified for the key in the JKS file. 
   -destkeystore: the JKS file that you want to create or an existing JKS file. 
   -deststoretype: The format of the file that you want to create is PKCS#12. 
   -srckeystore: the previously created PKCS#12 files. 
   -srcstoretype: The format of the source file is PKCS#12. 
   -srcstorepass: the password that is used to protect the PKCS#12 files. 
   -alias: the alias specified for the client certificate and private key of the user.

3. Obtain the created JKS file. After the keytool-based import succeeds, you can find the keystore.jks file in the execution directory.

package com.aliyun.sample;

import com.mysql.cj.jdbc.MysqlDataSource;
import java.sql.Connection;
import java.sql.SQLException;

public class Sample {

    public static void main(String[] args) {

        Connection conn = null;
        MysqlDataSource mysqlDS=null;

        try{
            mysqlDS = new MysqlDataSource();
            //You can specify the sslMode property based on your business requirements. For more information about the options for this property, see the description in the "CLI" section of this topic. 
            mysqlDS.setSslMode("VERIFY_IDENTITY");

            // The following code provides an example on how to use the JKS file of a cloud certificate. If a custom certificate is used, you must replace the related parameters with the path and password of the JKS file that is generated by using the custom certificate.
            //The truststore is used to store the CA certificate. In this example, the truststore type is set to JKS. 
            mysqlDS.setTrustCertificateKeyStoreType("JKS");
            //You must replace the content following file:/ with the actual path to your ApsaraDB-CA-Chain.jks file.
            mysqlDS.setTrustCertificateKeyStoreUrl("file:/D:\\ApsaraDB-CA-Chain\\ApsaraDB-CA-Chain.jks");
            //The password of the downloaded JKS file is fixed as apsaradb. 
            mysqlDS.setTrustCertificateKeyStorePassword("apsaradb");
          
            //The endpoint of your RDS instance.
            mysqlDS.setServerName("rm-xxxxxx.mysql.rds.aliyuncs.com");
            //The port number of your RDS instance.
            mysqlDS.setPort(3306);
            //The username of the account that is used to connect to your RDS instance.
            mysqlDS.setUser("xxxxxx");
            //The password of the account that is used to connect to your RDS instance.
            mysqlDS.setPassword("xxxxxx");
            //The name of the database that you want to connect on your RDS instance.
            mysqlDS.setDatabaseName("xxxxxx");

            conn = mysqlDS.getConnection();

        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }

}

Python

# Run the pip install pymysql command to install PyMySQL.

import pymysql

try:
    ssl_config = {"ca":"/path/to/path/ca.crt", "mode":"VERIFY_CA"} # You must set ca to the path to the certificate and mode to the SSL mode that you use.
    conn = pymysql.connect(host='******.mysql.rds.aliyuncs.com', user='*****', passwd='******', db='*****', ssl=ssl_config)
    cursor = conn.cursor()
    cursor.execute('select version()')
    data = cursor.fetchone()
    print('Database version:', data[0])
    cursor.close()
except pymysql.Error as e:
    print(e)