Transport Layer Security (TLS) is a cryptographic protocol that provides end-to-end communications security over networks. To resolve communication encryption problems, OceanBase Database supports the SSL/TLS and the TCP protocols.
OceanBase Database supports the following communication protocols:
MySQL: OceanBase Database communicates with MySQL clients of external applications by using the MySQL protocol. After you enable communication encryption, the configuration immediately takes effect and the data of all new MySQL connections is encrypted before transmission.
OB-RPC: OBServers in an OceanBase cluster communicate with each other by using the OB-RPC protocol. Connections between OBServers in a cluster are long connections. Therefore, the communication between them remains unencrypted after you enable encryption. To encrypt the communication between OBServers in an OceanBase cluster, you must restart the cluster.
OceanBase Database supports communication encryption over the SSL/TLS protocol on the entire data transmission process, as shown in the following figure.
To make the encryption feature easier to use, OceanBase Database allows you to specify different SSL authentication modes for different database users. The supported authentication modes are:
One-way SSL authentication: The OBServer must provide the CA certificate to the client. During the communication, the client verifies the validity of the CA certificate provided by the OBServer.
Mutual X.509 authentication: The OBServer and the client must provide their CA certificate to each other and verify the validity of the certificate from each other.
Special mutual authentication (combinations allowed)
Authentication with a specified encryption algorithm: the mutual X.509 authentication mode with a specified encryption algorithm.
Authentication with a specified issuer: the mutual X.509 authentication mode with a specified issuer of the client CA certificate.
Authentication with a specified SSL subject: the mutual X.509 authentication mode with a specified subject of the client CA certificate.