ssl_external_kms_info

Description

The ssl_external_kms_info parameter records some information required for the SSL feature of OceanBase Database to run. The information is recorded in a JSON string that specifies the related configurations for different SSL usage modes. The JSON string must contain the ssl_mode field.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  Only the sys tenant can modify this parameter. User tenants cannot modify this parameter.

Attributes

Considerations

• The default value of this parameter is an empty string. When the SSL switch is enabled, the SSL key will be read from the default file in the default path.

• The value of this parameter must be a valid JSON string. Otherwise, the parameter setting will fail.

• Currently, this parameter can only take two values: file and bkmi, which specify the ssl_mode.

  • When the value is file, the SSL key and certificate files are read from the local default path. No additional JSON fields are required.

  • When the value is bkmi, the SSL files are obtained from bkmi at runtime and are not persisted locally. The JSON string must also provide the complete application name, bkmi URL, bkmi root certificate, identity secret, identity secret password, SSL private key name, SSL private key version number, and SSL certificate name. These information must be valid and usable, meaning that the private key and certificate can be obtained from bkmi using these details. Otherwise, an error response code will be returned.

  To support other certificate issuing systems, the ssl_external_kms_info parameter can be customized and extended to other JSON strings.

Examples

Set the SSL certificate configuration to use the file mode.

obclient> ALTER SYSTEM SET ssl_external_kms_info = '
          {
          "ssl_mode":"file"
          }';