This topic describes how to set up transmission encryption for ODP.
Version information
ODP supports SSL starting from version 1.8.1. You can use the -V parameter to view the version information of ODP.
Run the following command in the installation directory of ODP to view the version information. Example:
./bin/obproxy -V
obproxy (OceanBase 1.8.1 3870.el6)
REVISION: 3870-local-8df895b0912b58dea3986320baeda7803bf57bd1
BUILD_TIME: Nov 2 2020 21:53:06
BUILD_FLAGS: -g -O2 -D_OB_VERSION=1000 -D_NO_EXCEPTION -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS -DNDEBUG -D__USE_LARGEFILE64 -D_FILE_OFFSET_BITS=64 -D_LARGE_FILE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -Wall -Werror -Wextra -Wunused-parameter -Wformat -Wconversion -Wno-deprecated -Wno-invalid-offsetof -finline-functions -fno-strict-aliasing -mtune=core2 -Wno-psabi -Wno-sign-compare -DGCC_52 -DUSE_POSIX_FALLOCATE -DSUPPORT_SSE4_2 -DHAVE_SCHED_GETCPU -DHAVE_REALTIME_COARSE -DOB_HAVE_EVENTFD -DHAVE_FALLOCATE -DHAVE_MINIDUMP
Configure the key and certificate
Currently, only file-based configuration is supported.
The configuration only applies to new connections and does not affect existing connections. The configuration takes effect immediately without requiring a restart.
After you log in to ODP as the root@proxysys user, you can configure the certificate, public key, and private key by using files. Example:
obclient> UPDATE proxyconfig.security_config SET CONFIG_VAL= '{"sourceType" : "FILE", "CA" : "certs/ca.pem", "publicKey" : "certs/server-cert.pem", "privateKey" : "certs/server-key.pem"}' WHERE APP_NAME = 'obproxy' and VERSION = '1';
In the preceding example, the sourceType field must be set to FILE. The CA field indicates the location of the CA certificate, the publicKey field indicates the location of the public key certificate, and the privateKey field indicates the location of the private key certificate.
You can run the SELECT statement to view whether the certificate, public key, and private key are configured. Example:
obclient> SELECT CONFIG_VAL FROM proxyconfig.security_config WHERE APP_NAME = 'obproxy';
+---------------+
| CONFIG_VAL |
+---------------+
| SSL INFO FILE |
+---------------+
1 row in set (0.00 sec)
Configure the SSL connection between the client and ODP
The enable_client_ssl parameter specifies whether to enable the SSL connection between the client and ODP. The default value is false, which indicates that the SSL connection is not enabled between the client and ODP.
If the enable_client_ssl parameter is set to true, ODP can provide the SSL feature to the client.
The configuration only applies to new connections and does not affect existing connections. The configuration takes effect immediately without requiring a restart.
To establish an SSL connection between the client and ODP, the client must support the SSL feature. For example, for the MySQL official client program (mysql), you need to check whether the corresponding program version supports the SSL feature.
After you log in to ODP as the client, you can send the '\s' string to view the SSL field value. This field indicates whether the SSL feature is used for the connection between the client and ODP.
If the value of the SSL field is not
Not in use, the SSL feature is used for the connection between the client and ODP.If the value of the SSL field is
Not in use, the SSL feature is not used for the connection between the client and ODP.
Example:
obclient> \s
--------------
obclient Ver 1.1.8 Distrib 5.7.24, for Linux (x86_64) using EditLine wrapper
Connection id: 3221506046
Current database: test
Current user: root@xx.xx.xx.xx
SSL: Cipher in use is DHE-RSA-AES128-GCM-SHA256
Current pager: less
Using outfile: ''
Using delimiter: ;
Server version: 5.7.25 OceanBase 2.2.60 (r1-63cbd3084a3283523f09d6ba20795f77b95e046b) (Built Jun 30 2020 10:10:29)
Protocol version: 10
Connection: xx.xx.xx.xx via TCP/IP
Server characterset: utf8mb4
Db characterset: utf8mb4
Client characterset: utf8mb4
Conn. characterset: utf8mb4
TCP port: 13213
Active --------------
Configure the SSL connection between ODP and the server
The enable_server_ssl parameter specifies whether to enable the SSL connection between ODP and the server. The default value is false, which indicates that the SSL connection is not enabled between ODP and the server.
If the enable_server_ssl parameter is set to true, ODP can enable the SSL feature for the server.
The configuration only applies to new connections and does not affect existing connections. The configuration takes effect immediately without requiring a restart.