MySQL Protocol SSL Encryption Guide

Prerequisites

The Lindorm Wide Table Engine is activated.

Procedure

1. Log on to the Lindorm console.

2. In the upper-left corner of the page, select the region where the instance is deployed.

3. On the Instances page, click the ID of the target instance or click View Instance Details in the Actions column for the instance.

4. In the left-side navigation pane of the instance details page, click Wide Table Engine > Data Security.

5. In the Data Link SSL section, enable the service in the Current Status: area.

6. Wait for the SSL encryption service to be enabled. When the page displays the following information, the SSL encryption service is enabled:

   • Current Status:: Enabled

   • SSL Certificate Validity Period:: The certificate expiration time displayed on the page, for example, 2036-06-13 18:02:25

   • SSL Certificate Validity:: Valid

   • A Download CA Certificate button is provided.

Encryption link only

If you only need to secure the link between the client and the server with encryption, use sslMode=REQUIRED. This mode enables TLS encryption without requiring the client to configure an additional CA root certificate.

• MySQL command example

  mysql --ssl-mode=REQUIRED \
    -h <host> \
    -P 33060 \
    -u <user> \
    -p \
    -D <database> \
    --get-server-public-key

  For detailed usage, see Use a MySQL client to connect to and use LindormTable.

• JDBC example

  String url = "jdbc:mysql://<host>:33060/<database>"
      + "?sslMode=REQUIRED"
      + "&allowPublicKeyRetrieval=true";
  Connection connection = DriverManager.getConnection(url, user, password);

  For detailed usage, see Application development using the Java JDBC interface.

Strict certificate chain verification

If the client needs to confirm that the server certificate is issued by a trusted CA, use sslMode=VERIFY_CA and specify the CA certificate downloaded from the console with --ssl-ca.

mysql --ssl-mode=VERIFY_CA \
  --ssl-ca=/path/to/Lindorm-CA.crt \
  -h <host> \
  -P 33060 \
  -u <user> \
  -p \
  -D <database> \
  --get-server-public-key

Example query:

mysql --ssl-mode=VERIFY_CA \
  --ssl-ca=/path/to/Lindorm-CA.crt \
  -h <host> -P 33060 -u <user> -p -D <database> \
  --get-server-public-key \
  -e "SELECT 1 AS ok"

If ok = 1 is returned, the client has completed the SSL handshake and query based on the CA certificate.

VERIFY_IDENTITY mode description

VERIFY_IDENTITY builds on VERIFY_CA by additionally verifying that the connection host name matches the SAN/CN declared in the server certificate. Therefore, to use this mode, the host that the client connects to must exactly match a domain name or IP address declared in the certificate.

Generate a truststore

keytool -importcert \
  -alias lindorm-ca \
  -file /path/to/Lindorm-CA.crt \
  -keystore /path/to/lindorm-ca.p12 \
  -storetype PKCS12 \
  -storepass changeit \
  -noprompt

JDBC URL

String url = "jdbc:mysql://<host>:33060/<database>"
    + "?sslMode=VERIFY_CA"
    + "&allowPublicKeyRetrieval=true"
    + "&trustCertificateKeyStoreUrl=file:/path/to/lindorm-ca.p12"
    + "&trustCertificateKeyStorePassword=changeit"
    + "&trustCertificateKeyStoreType=PKCS12";
Connection connection = DriverManager.getConnection(url, user, password);

Note: trustCertificateKeyStoreUrl takes the file path of the truststore, not the path of the server certificate. Import the CA certificate downloaded from the console into a PKCS12 or JKS truststore before passing it to JDBC.