ssl_external_kms_info

Description

The ssl_external_kms_info parameter records some information required for the SSL feature of OceanBase Database to run. It records the related configurations for different SSL usage modes in a JSON string. The JSON string must contain the ssl_mode field.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query the value of this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  Only the sys tenant can modify this parameter. User tenants cannot modify this parameter.

Attributes

Considerations

• The default value of this parameter is an empty string. When the SSL switch is turned on, the SSL key will be read from the default path.

• The value of this parameter must be a valid JSON string. Otherwise, the configuration will fail.

• Currently, this parameter can only take two values: file and bkmi, which specify the ssl_mode.

  • When the value is file, the SSL key and certificate files are read from the local default path, and no additional JSON fields are required.

  • When the value is bkmi, the SSL files are obtained from bkmi at runtime and are not persisted locally. The JSON string must also provide the complete application name, bkmi URL, bkmi root certificate, identity secret key, identity secret key password, SSL private key name, SSL private key version number, and SSL certificate name. These information must be valid and available, meaning that the private key and certificate can be obtained from bkmi using these details. Otherwise, an error response code will be returned.

  To support external certificate authorities, the ssl_external_kms_info parameter can be customized to include other JSON strings.

Examples

Set the SSL certificate configuration to use the file mode.

obclient> ALTER SYSTEM SET ssl_external_kms_info = '
          {
          "ssl_mode":"file"
          }';