ssl_external_kms_info

Description

The ssl_external_kms_info parameter records information required for the SSL feature of OceanBase Database to run. The information is recorded in a JSON string that specifies the related configurations for different SSL usage modes. The JSON string must contain at least the ssl_mode field.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  Only the sys tenant can modify this parameter. User tenants cannot modify this parameter.

Attributes

Considerations

• The default value of this parameter is an empty string. After you enable the SSL feature, the system uses the default SSL key file in the default path.

• The value of this parameter must be a valid JSON string. Otherwise, the parameter setting fails.

• The value of this parameter can be set to file or bkmi, which specifies the ssl_mode value.

  • If you set the value to file, the system reads the SSL key and certificate files from the default local path without requiring additional JSON fields.

  • If you set the value to bkmi, the system retrieves the SSL files from bkmi during runtime without persisting them locally. In this case, the JSON string must provide the application name, bkmi URL, bkmi root certificate, identity secret, identity secret password, SSL private key name, SSL private key version, and SSL certificate name. These information must be valid and available, meaning that the system can retrieve the private key and certificate from bkmi using these details. Otherwise, an error response is returned.

  To support other certificate authorities, you can customize and extend the ssl_external_kms_info parameter to other JSON strings.

Examples

Set the SSL certificate configuration to the file mode.

obclient> ALTER SYSTEM SET ssl_external_kms_info = '
          {
          "ssl_mode":"file"
          }';