Enable the HTTPS protocol
Enable HTTPS to encrypt data in transit with Secure Sockets Layer (SSL). After HTTPS is enabled, you can connect to your ApsaraDB for ClickHouse cluster over HTTPS.
Background
Secure Sockets Layer (SSL) is a security protocol that establishes an encrypted channel between a client and a server for secure data transmission. The Internet Engineering Task Force (IETF) standardized SSL 3.0 and renamed it Transport Layer Security (TLS). Although SSL remains a common term, enabling SSL encryption today typically means enabling TLS encryption.
ApsaraDB for ClickHouse supports SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2.
Limitations
Only ApsaraDB for ClickHouse clusters running version 20.8 or later support the HTTPS protocol.
Notes
-
For community-compatible edition clusters running version 20.8 or later created after December 1, 2021, the HTTPS protocol is enabled by default. You must manually enable the protocol for such clusters created before this date.
-
Enabling the HTTPS protocol restarts the ApsaraDB for ClickHouse cluster. Proceed with caution.
-
Connecting to an ApsaraDB for ClickHouse cluster over the HTTPS protocol increases network connection latency.
-
Connecting to an ApsaraDB for ClickHouse cluster over HTTPS significantly increases CPU usage. Use HTTPS when you connect to ApsaraDB for ClickHouse over the public internet and require encryption. VPC connections are relatively secure, so HTTPS is generally not required to access ApsaraDB for ClickHouse.
-
The same SSL CA certificate is used for connections to an ApsaraDB for ClickHouse cluster, whether you connect through a public endpoint or a VPC endpoint. The certificate is free and valid until December 25, 2031.
-
The HTTPS protocol is supported for both public and VPC endpoints. The HTTPS port is fixed at 8443.
-
Enabling the HTTPS protocol does not affect connections to your ApsaraDB for ClickHouse cluster that use other protocols.
Procedure
-
Log on to the ApsaraDB for ClickHouse console.
-
On the Clusters page, choose Clusters of Community-compatible Edition, and then click the ID of the target cluster.
-
On the Cluster Information page, click Enable HTTPS Protocol.
-
In the Note dialog box, click OK.
After HTTPS is enabled, the cluster status changes to Restarting. This process takes about one minute. Wait until the cluster status changes to Running, which indicates that HTTPS is enabled.
-
Click Download CA Certificate.
The downloaded file is named ClickHouse-CA-Chain.pem. Use this file to import the CA certificate into other systems or applications.