Applicability
This topic applies only to OCP Enterprise Edition. OCP Community Edition does not provide this feature.
To enhance link security, OceanBase Database connections support enabling Secure Sockets Layer (SSL) link encryption. By encrypting network connections at the transport layer, it ensures that communication traffic between nodes is not monitored or tampered with, thereby improving the security of communication data. SSL link encryption can be applied to RPC communications between OceanBases, communications between OBProxy and OceanBase, and communications between business applications and OBProxy. After enabling SSL link encryption, clients can establish connections using either SSL authentication or general authentication.
This page describes the procedure for managing SSL link encryption.
Enable SSL Link Encryption
Enabling SSL link encryption may slightly impact cluster performance, as data encryption and decryption consume computational resources. It is recommended to enable SSL link encryption only when external network connections are required or when transmission encryption is needed.
Prerequisites
Ensure the current user logged in to OCP has the ADMIN or ORG_ADMIN role.
The OceanBase cluster is version V4.x or later.
Procedure
Log in to OCP.
In the left navigation bar, click Cluster. The system enters the Clusters page by default.
On the Clusters page, select the target cluster and click its name to go to the cluster Overview page.
In the left navigation bar of the displayed page, click Security Configuration. The SSL Encryption tab is displayed by default.
Click Enable, select an SSL server certificate name in the dialog box, and click Enable.
If the required certificate is missing from the drop-down list, you can click Upload Certificate to add it.
Disable SSL Link Encryption
This section describes how to disable SSL link encryption. Disabling SSL link encryption is a minute-level operation; please be patient.
Prerequisites
Ensure the current user logged in to OCP has the ADMIN or ORG_ADMIN role.
The OceanBase cluster is version V4.x or later.
SSL link encryption has been enabled.
The SSL server certificate has not expired.
Procedure
Log in to OCP.
In the left-side navigation pane, click Cluster. The Clusters page appears by default.
On the Clusters page, find the target cluster and click its name. The cluster Overview page appears.
In the left-side navigation pane of the page that appears, click Security Configuration. The SSL Encryption tab appears by default.
Click Disable Encryption in the upper-right corner, then click Disable in the dialog box.
Update SSL Server certificate
You can update the SSL server certificate online when it is about to expire or has expired. After the encryption certificate is regenerated, the previously created SSL links will continue to be valid, but new links will fail. You need to be aware of this change.
Prerequisites
Ensure that the current user logged in to OCP has the ADMIN or ORG_ADMIN role.
The OceanBase cluster is version V4.x or later.
SSL link encryption is enabled.
Procedure
Log in to OCP.
In the left-side navigation pane, click Cluster. The Clusters page appears by default.
On the Clusters page, find the target cluster and click its name. The cluster Overview page appears.
In the left-side navigation pane of the page that appears, click Security Configuration. The SSL Encryption tab appears by default.
Click Update SSL Server Certificate in the upper-right corner. In the dialog box, select the SSL server certificate name and click Update.
If the required certificate is missing from the drop-down list, you can click Upload Certificate to add it.
Download the CA certificate
You can download the CA certificate to your local device as a compressed package. The package contains the following three files:
p7bfile: used to import the CA certificate on Windows systems.pemfile: used to import the CA certificate on other systems or in applications.jksfile: a Java TrustStore certificate storage file with the password set to OceanBase. It is used to import the CA certificate chain in Java programs.
Prerequisites
Ensure the current OCP user is in the ADMIN or ORG_ADMIN role.
The OceanBase cluster is V4.x or later.
SSL link encryption is enabled.
The SSL server certificate has not expired.
Procedure
Log in to OCP.
In the left navigation bar, click Cluster. The system enters the Clusters page by default.
On the Clusters page, select the target cluster and click its name to go to the cluster Overview page.
In the left navigation bar of the displayed page, click Security Configuration. The SSL Encryption tab is displayed by default.
Click Download CA Certificate.