Configure a client CA certificate

Prerequisites

• The cluster runs PolarDB for PostgreSQL 14, 15, or a later version. For clusters that run PolarDB for PostgreSQL 14, the kernel version must be 14.10.21.0 or later. This is required to configure custom certificates and client CA certificates for the primary endpoint.

• The PolarProxy version of the cluster must be 2.3.51 or later. This version is required to configure custom certificates and client CA certificates for the cluster endpoint and custom endpoints.

• You have completed Configure SSL encryption by using a cloud certificate or Configure a custom certificate.

• The OpenSSL tool is installed.

  Note

  Linux includes OpenSSL by default. If you use Windows, download and install the OpenSSL software package.

Usage notes

• After you configure a client CA certificate, you must re-establish existing connections for the change to take effect.

• The following operations cause a brief connection interruption: configuring a client CA certificate, configuring a client certificate revocation list (CRL) file, disabling a client CA certificate, and disabling a client certificate revocation list (CRL) file. We recommend that you perform these operations during off-peak hours.

Step 1: Obtain a client certificate

The following example uses CentOS. The openssl commands are the same on Windows.

1. Generate a self-signed certificate (ca1.crt) and its private key (ca1.key).

   openssl req -new -x509 -days 3650 -nodes -out ca1.crt -keyout ca1.key -subj "/CN=root-ca1"

2. Generate a client certificate signing request file (client.csr) and a client private key (client.key).

   openssl req -new -nodes -text -out client.csr -keyout client.key -subj "/CN=<client_username>"

   Note

   In this command, set the CN value in the -subj parameter to the client's database username.

3. Generate the client certificate (client.crt).

   openssl x509 -req -in client.csr -text -days 365  -CA ca1.crt -CAkey ca1.key -CAcreateserial  -out client.crt

Run the ls command to view the generated files:

# ls
ca1.crt  ca1.key  ca1.srl  client.crt  client.csr  client.key

Key files:

1. client.crt: The client certificate.

2. client.key: The client's private key.

3. ca1.crt: The self-signed root CA certificate.

4. ca1.key: The private key for the self-signed root CA certificate.

Step 2: Configure the client CA certificate

1. Log on to the PolarDB console.

2. In the upper-left corner of the page, select the region where your cluster is located.

3. Find the target cluster and click the cluster ID.

4. In the left-side navigation pane, click Configuration and Management > Security Management.

5. On the SSL Configuration tab, next to the primary endpoint or cluster endpoint that you want to configure, click the Configure Client CA Certificate button.

6. In the Configure Client CA Certificate dialog box, set Status to Enable, paste the content of the self-signed certificate file (ca1.crt), and then click OK.

   Note

   For information about how to obtain the self-signed certificate file (ca1.crt), see Step 1: Obtain a client certificate.

Step 3: Connect to the database

PolarDB for PostgreSQL and databases support remote connections over SSL. For details, see Connect to a PolarDB for PostgreSQL or PolarDB for PostgreSQL (Compatible with Oracle) database over SSL .

Step 4: (Optional) Configure a CRL file

If you no longer use a specific client certificate, you can revoke it. The database will then reject connections from clients that use this certificate.

1. Prepare the configuration files.

   touch /etc/pki/CA/index.txt
   echo 1000 > /etc/pki/CA/crlnumber

   Note

   If you use Windows, follow these steps:

   1. Create a CA folder in the \bin directory of the OpenSSL installation directory.

   2. Create an index.txt file in the CA folder.

   3. Run the following command:

      echo 1000 > <OpenSSL installation directory>\bin\CA\crlnumber

   4. Modify the openssl.cnf file in the C:\Program Files\Common Files\SSL\ directory.

      # Find the [ CA_default ] section.
      dir = "<OpenSSL installation directory>\\bin\\CA"

2. Revoke the client certificate (client.crt).

   openssl ca -revoke client.crt -cert ca1.crt -keyfile ca1.key

   Note

   This command requires the self-signed certificate (ca1.crt) and its private key (ca1.key). For more information, see Step 1: Obtain a client certificate.

3. Generate the client certificate revocation list (CRL) file (client.crl).

   openssl ca -gencrl -out client.crl -cert ca1.crt -keyfile ca1.key

4. Go to the Configuration and Management > Security Management page. On the SSL Configuration tab, next to the primary endpoint or cluster endpoint that you want to configure, click the Configure Revocation File of Client button.

5. In the Configure Revocation File of Client dialog box, set Status to Enable, paste the content of the client certificate revocation list (CRL) file (client.crl), and then click OK.

Step 5: (Optional) Disable the client CA certificate

To disable the client CA certificate for a primary endpoint or cluster endpoint, go to the SSL Configuration tab and click Configure Client CA Certificate for that endpoint. In the Configure Client CA Certificate dialog box that opens, click Close and then OK.

Step 6: (Optional) Disable the CRL file

To disable the client certificate revocation list file for a primary endpoint or cluster endpoint, go to the SSL Configuration tab and click Configure Revocation File of Client for that endpoint. In the Configure Revocation File of Client dialog box that opens, click Close and then OK.