Applicability
This topic applies only to OCP Enterprise Edition. OCP Community Edition does not support this feature.
To enhance link security, OceanBase Database supports SSL (Secure Sockets Layer) link encryption. By encrypting network connections at the transport layer, it ensures that communication traffic between nodes remains unmonitored and unaltered, thereby improving the security of transmitted data. SSL link encryption can be applied to RPC communications between OceanBase databases, between OBProxy and OceanBase, and between business applications and OBProxy. After enabling SSL link encryption, clients can establish connections using either SSL authentication or general authentication.
This topic describes how to manage SSL link encryption.
Enable SSL encryption for links
After SSL connection encryption is enabled, the performance of the cluster is slightly affected. Therefore, we recommend that you enable SSL connection encryption only when an external network connection or data encryption is required.
Prerequisites
Make sure the user logged in to OCP is of ADMIN or ORG_ADMIN role.
OceanBase Database cluster is of V4.x or later.
Procedure
Log in to OCP.
In the left-side navigation pane, choose Cluster. The Clusters page automatically appears.
In the Clusters list, click the name of the target cluster to go to the Overview page of the cluster.
On the left navigation pane of the displayed page, click Security Configuration. The SSL Encryption tab is displayed by default.
Click Enable, select the SSL server certificate name in the dialog box, and click Enable.
If the desired certificate is not listed, click Upload Certificate to add it.
Disable SSL Link Encryption
This topic describes how to disable link encryption. Disabling link encryption takes a few minutes. Please be patient.
Prerequisites
Make sure the user logged in to OCP has the ADMIN or ORG_ADMIN role.
An OceanBase cluster of V4.x or a later version.
The SSL server certificate has not expired.
Procedure
Log in to the OCP console.
In the left navigation pane, click Cluster. The Clusters page automatically appears.
In the Clusters section, choose the target cluster and click its name to go to the Overview page of the cluster.
On the left navigation pane of the displayed page, click Security Configuration, which displays the SSL Encryption tab by default.
In the upper-right corner, click Disable Encryption, and then click Close in the dialog box.
Update SSL Server certificate
When the SSL server certificate is about to expire or has already expired, you can update the SSL server certificate online. After the encryption certificate is regenerated, existing SSL links will still be effective, but new links will fail. Please be aware of these changes.
Prerequisites
Make sure that the current login user is ADMIN role or ORG_ADMIN role on the OCP console.
The cluster version of OceanBase is V4.x or later.
SSL encryption is enabled for the link.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click Cluster. The system displays the Clusters page.
On the Clusters page, click the name of the target cluster to go to its Overview page.
On the left navigation pane of the displayed page, click Security Configuration. The SSL Encryption tab is displayed by default.
Click Update SSL Server Certificate in the upper-right corner. In the dialog box, select the name of the SSL server certificate and click Update.
If the required certificate is missing from the drop-down list, you can add the certificate by choosing Upload Certificate.
Download the CA certificate
Supports downloading CA certificates as a compressed package to your local storage. The compressed package includes the following three files:
p7bfile: For importing CA certificate on Windows.pemfile: to import the CA certificate into another system or application.jksfiles: truststore files that store certificates in Java. The password is OceanBase, which is used to import a CA certificate chain in a Java program.
Prerequisites
Make sure that the current logged-in user is in the ADMIN or ORG_ADMIN role.
OceanBase Database cluster is of V4.x or later.
SSL encryption for link is enabled.
The SSL server certificate has not expired.
Procedure
Log in to OCP.
In the left-side navigation pane, click Cluster. The system displays the Clusters page by default.
On the Clusters page, click the name of the cluster you want to operate. The Overview page of the cluster is displayed.
In the left-side navigation pane of the displayed page, click Security Configuration. By default, the SSL Encryption tab appears.
Click Download CA Certificate.