Applicability
This topic applies only to OceanBase Database Enterprise Edition. OceanBase Database Community Edition does not support this feature.
To enhance link security, OceanBase Database supports SSL (Secure Sockets Layer) link encryption. By encrypting network connections at the transport layer, SSL ensures that communication traffic between nodes is not intercepted or tampered with, thereby improving the security of transmitted data. SSL link encryption can be applied to RPC communications between OceanBase databases, between OceanBase Database and OBProxy, and between business applications and OBProxy. After enabling SSL link encryption, clients can establish connections using either SSL authentication or general authentication.
This topic describes how to manage SSL link encryption.
Enable SSL Link Encryption
Enabling SSL for cluster communication will have a minor impact on cluster performance (since encryption and decryption of transmitted data consume computing resources). It is recommended to only enable this feature if the cluster requires an internet connection or encryption for data transmission.
Prerequisites
Make sure that the current OCP logged-in user has the ADMIN role or the ORG_ADMIN role.
The OBProxy cluster is of V2.0 or later.
SSL encryption is not effective for direct connect addresses.
Procedure
Log in to the OCP console.
In the left-side navigation pane, choose OBProxy.
In the cluster list, select the OBProxy cluster for which you want to perform the operation and go to the Overview page of the OBProxy cluster.
In the left-side navigation pane, click Security Configuration to go to the SSL Encryption tab.
Click Enable, select the SSL Server certificate in the dialog box, and then click Enable.
If the needed certificate is missing in the list, you can click Upload certificate to add it.
Disable SSL link encryption
This topic describes how to disable SSL link encryption. Disabling SSL link encryption takes several minutes. Please wait patiently.
Prerequisites
Make sure the current user logged in to OCP has ADMIN or ORG_ADMIN privileges.
SSL is enabled for secure connections.
The SSL server certificate is not expired.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click OBProxy.
Select the OBProxy cluster to which you want to apply the configurations. The Overview page of the OBProxy cluster appears.
In the left-side navigation pane, click Security Configuration. The SSL Encryption tab appears by default.
Click Disable Encryption in the upper-right corner, and then click Close in the dialog box.
Update the SSL Server certificate
Before or after an SSL Server certificate expires, you can update it online. After a new SSL certificate is generated, links established using previous SSL certificates still work. But links established using the new SSL certificate fail. Therefore, you must pay special attention to changes.
Prerequisites
Ensure that the logged in OCP user has the ADMIN or ORG_ADMIN role.
SSL link encryption is enabled.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click OBProxy.
Select the OBProxy cluster that you want to operate and go to its Overview page.
In the left-side navigation pane, click Security Configuration. The SSL Encryption tab appears.
On the top right, click Update SSL Server Certificate. Select the SSL Server certificate name and click Update.
If the certificate that you want to use is not listed, you can upload it by clicking Upload Certificate.
Download the CA certificate
Supports the download and compression of CA certificates for storage on a local device. The package contains the following three files:
.p7bfiles: Used for importing CA certificates on Windows..pemfile: For importing the CA certificate into other systems or applications.jksfile: the certificate store file for the truststore in Java. The password is OceanBase. You can import the CA certificate chain to Java programs.
Requirements
Make sure that the user who logs in to OCP is of ADMIN or ORG_ADMIN role.
SSL is enabled for link encryption.
The SSL server certificate is still valid.
Procedure
Log in to OCP.
In the left-side navigation pane, click OBProxy.
Select the OBProxy cluster that you want to operate on the OBProxy Clusters page, and go to its Overview page.
Select Security Configuration in the left-side navigation pane. The SSL Encryption tab appears by default.
Click Download CA Certificate.