Manage security configurations

To enhance link security, OceanBase Database connections support enabling Secure Sockets Layer (SSL) encryption. By encrypting network connections at the transport layer, it ensures that communication traffic between nodes is not eavesdropped on or tampered with, thereby improving the security of communication data. SSL encryption can be applied to RPC communications between OceanBases, communications between OBProxy and OceanBase, and communications between business applications and OBProxy. After enabling SSL encryption, clients can establish connections using either SSL authentication or general authentication.

This page describes the procedure for enabling SSL encryption.

Enable SSL encryption

Enabling SSL encryption may slightly impact cluster performance, as data encryption and decryption consume computational resources. It is recommended to enable SSL encryption only when external network connections are required or when transmission encryption is needed.

Prerequisites

• Ensure the current user logged in to OCP has the ADMIN or ORG_ADMIN role.

• The OBProxy cluster is version V2.0 or later.

• The SSL encryption feature does not take effect for direct connection addresses.

Procedure

1. Log in to OCP.

2. In the left navigation bar, click OBProxy.

3. In the cluster list, select the OBProxy cluster you want to operate on to go to its Overview page.

4. Click Security Configuration in the left navigation bar. The SSL Encryption tab opens by default.

5. Click Enable, select an SSL server certificate name in the dialog box, and click Enable.

   If the required certificate is missing from the drop-down list, you can click Upload Certificate to add it.

Disable SSL encryption

This section describes how to disable SSL encryption. Disabling SSL encryption is a minute-level operation; please be patient.

Prerequisites

• Ensure the current user logged in to OCP has the ADMIN or ORG_ADMIN role.

• SSL encryption has been enabled.

• The SSL server certificate has not expired.

Procedure

1. Log in to OCP.

2. In the left-side navigation pane, click OBProxy.

3. In the cluster list, select the OBProxy cluster you want to operate on to go to its Overview page.

4. Click Security Configuration in the left-side navigation pane. The SSL Encryption tab opens by default.

5. Click Disable Encryption in the upper-right corner, and then click Disable in the dialog box.

Update SSL Server certificate

When the SSL server certificate is about to expire or has already expired, you can update it online. After the encryption certificate is regenerated, previously created SSL links will continue to be valid, but new links will fail. You need to be aware of this change.

Prerequisites

• Ensure the current user logged in to OCP has the ADMIN or ORG_ADMIN role.

• SSL link encryption is enabled.

Procedure

1. Log in to OCP.

2. In the left-side navigation pane, click OBProxy.

3. In the cluster list, select the OBProxy cluster you want to operate on to go to its Overview page.

4. Click Security Configuration in the left-side navigation pane. The SSL Encryption tab opens by default.

5. Click Update SSL Server Certificate in the upper-right corner. In the dialog box, select the SSL server certificate name and click Update.

   If the required certificate is missing from the drop-down list, you can click Upload Certificate to add it.

Download CA certificate

You can download the CA certificate to your local device as a compressed package. The package contains the following three files:

• p7b file: used to import the CA certificate on Windows systems.

• pem file: used to import the CA certificate on other systems or applications.

• jks file: a Java TrustStore certificate storage file with the password set to OceanBase, used to import the CA certificate chain in Java programs.

Prerequisites

• Ensure the current user logged in to OCP has the ADMIN or ORG_ADMIN role.

• SSL encryption is enabled.

• The SSL server certificate has not expired.

Procedure

1. Log in to OCP.

2. In the left navigation pane, click OBProxy.

3. In the cluster list, select the OBProxy cluster you want to operate on to go to its Overview page.

4. Click Security Configuration in the left navigation pane. The SSL Encryption tab opens by default.

5. Click Download CA Certificate.