Applicability
This topic applies only to OceanBase Cloud Enterprise Edition. OceanBase Cloud Community Edition does not support this feature.
To enhance link security, OceanBase Database supports SSL (Secure Sockets Layer) link encryption. By encrypting network connections at the transport layer, it ensures that communication traffic between nodes is not eavesdropped on or tampered with, thereby improving the security of communication data. SSL link encryption can be applied to RPC communication between OceanBase Database instances, communication between OceanBase Proxy and OceanBase Database, and communication between business applications and OceanBase Proxy. After enabling SSL link encryption, clients can establish connections using either SSL authentication or general authentication.
This topic describes how to manage SSL link encryption.
Enable SSL link encryption
After SSL link encryption is enabled, the cluster performance will be slightly reduced (data transmission encryption and decryption consume some computing resources). We recommend that you enable SSL link encryption only when you need to connect to the Internet or require data transmission encryption.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
The OBProxy cluster is of V2.0 or later.
SSL link encryption does not take effect on the direct connection address.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click OBProxy.
In the cluster list, click the name of the OBProxy cluster that you want to manage to go to the Overview page of the cluster.
Click Security Configuration in the left-side navigation pane. The SSL Encryption tab appears.
Click Enable. In the dialog box that appears, select the name of the SSL server certificate and click Enable.
If the required certificate is not in the drop-down list, you can click Upload Certificate to add it.
Disable SSL link encryption
This topic describes how to disable SSL link encryption. Disabling SSL link encryption takes about a minute. Please wait patiently.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
SSL link encryption is enabled. For more information, see Enable SSL link encryption.
The SSL server certificate has not expired.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click OBProxy.
In the cluster list, click the name of the OBProxy cluster that you want to manage to go to the Overview page of the cluster.
Click Security Configuration in the left-side navigation pane. The SSL Encryption tab appears.
Click Disable Encryption in the upper-right corner. In the dialog box that appears, click Close.
Update the SSL server certificate
You can update the SSL server certificate online when it is about to expire or has expired. After the encryption certificate is regenerated, the historical SSL links continue to be effective, but new links will fail. You need to be aware of these changes.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
SSL link encryption is enabled. For more information, see Enable SSL link encryption.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click OBProxy.
In the cluster list, click the name of the OBProxy cluster that you want to manage to go to the Overview page of the cluster.
Click Security Configuration in the left-side navigation pane. The SSL Encryption tab appears.
Click Update SSL Server Certificate in the upper-right corner. In the dialog box that appears, select the name of the SSL server certificate and click Update.
If the required certificate is not in the drop-down list, you can click Upload Certificate to add it.
Download the CA certificate
You can download the CA certificate as a compressed file to your local device. The compressed file contains the following three files:
p7bfile: used to import the CA certificate to a Windows system.pemfile: used to import the CA certificate to other systems or applications.jksfile: a truststore certificate storage file for Java. The password is OceanBase, and it is used to import the CA certificate chain to a Java program.
Prerequisites
You have logged in to the OCP console as the ADMIN or ORG_ADMIN role.
SSL link encryption is enabled. For more information, see Enable SSL link encryption.
The SSL server certificate has not expired.
Procedure
Log in to the OCP console.
In the left-side navigation pane, click OBProxy.
In the cluster list, click the name of the OBProxy cluster that you want to manage to go to the Overview page of the cluster.
Click Security Configuration in the left-side navigation pane. The SSL Encryption tab appears.
Click Download CA Certificate.