Applicability
This topic applies only to OCP Enterprise Edition. OCP Community Edition does not support this feature.
To enhance link security, OceanBase Database supports SSL (Secure Sockets Layer) link encryption. By encrypting network connections at the transport layer, SSL ensures that communication traffic between nodes is not intercepted or tampered with, thereby improving the security of communication data. SSL link encryption can be applied to RPC communication between OceanBase Database nodes, communication between OBProxy and OceanBase Database, and communication between business applications and OBProxy. After enabling SSL link encryption, clients can establish connections using either SSL authentication or general authentication.
This topic describes how to manage SSL link encryption.
Enable SSL link encryption
After SSL link encryption is enabled, the cluster performance will slightly decrease (data transmission encryption and decryption consume some computing resources). We recommend that you enable SSL link encryption only when the cluster needs to connect to the Internet or requires data transmission encryption.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
The OceanBase cluster is of V4.x or later.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click Cluster. The Clusters page automatically appears.
In the Clusters list, find the target cluster, click its name, and go to the Overview page.
In the left-side navigation pane of the page that appears, click Security Configuration. The SSL Encryption tab appears by default.
Click Enable. In the dialog box that appears, select the name of the SSL server certificate and click Enable.
If the required certificate is not in the drop-down list, you can click Upload Certificate to upload it.
Disable SSL link encryption
This topic describes how to disable SSL link encryption. Disabling SSL link encryption is a minute-level operation. Please wait patiently.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
The OceanBase cluster is of V4.x or later.
SSL link encryption has been enabled. For more information, see Enable SSL link encryption.
The SSL server certificate has not expired.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click Cluster. The Clusters page automatically appears.
In the Clusters list, find the target cluster, click its name, and go to the Overview page.
In the left-side navigation pane of the page that appears, click Security Configuration. The SSL Encryption tab appears by default.
Click Disable Encryption in the upper-right corner. In the dialog box that appears, click Close.
Update the SSL server certificate
When the SSL server certificate is about to expire or has expired, you can update it online. After the new certificate is generated, the existing SSL links will continue to work, but new links will fail. Please be aware of these changes.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
The OceanBase cluster is of V4.x or later.
SSL link encryption has been enabled. For more information, see Enable SSL link encryption.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click Cluster. The Clusters page automatically appears.
In the Clusters list, find the target cluster, click its name, and go to the Overview page.
In the left-side navigation pane of the page that appears, click Security Configuration. The SSL Encryption tab appears by default.
Click Update SSL Server Certificate in the upper-right corner. In the dialog box that appears, select the name of the SSL server certificate and click Update.
If the required certificate is not in the drop-down list, you can click Upload Certificate to upload it.
Download the CA certificate
You can download the CA certificate in a compressed package to your local device. The compressed package contains the following three files:
.p7bfile: used to import the CA certificate on Windows..pemfile: used to import the CA certificate on other systems or applications..jksfile: the truststore certificate storage file in Java. The password is OceanBase, and it is used to import the CA certificate chain in Java programs.
Prerequisites
The user logged in to the OCP console must be of the ADMIN or ORG_ADMIN role.
The OceanBase cluster must be of V4.x or later.
SSL link encryption is enabled. For more information, see Enable SSL link encryption.
The SSL server certificate has not expired.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click Cluster. The Clusters page automatically appears.
In the Clusters list, find the target cluster and click its name to go to the Overview page.
In the left-side navigation pane of the page that appears, click Security Configuration. The SSL Encryption tab appears.
Click Download CA Certificate.