Transport Layer Security (TLS) is a cryptographic protocol that provides end-to-end communications security over networks. In addition to TCP, OceanBase Database also supports the Secure Sockets Layer (SSL) and TLS protocols to implement communication encryption.
OceanBase Database supports the following communication protocols:
MySQL protocol: OceanBase Database communicates with MySQL clients of external applications by using the MySQL protocol. After you enable communication encryption, the configuration immediately takes effect and the data of all new MySQL connections is encrypted before transmission.
OB-RPC protocol: OBServer nodes in an OceanBase cluster communicate with each other by using the OB-RPC protocol. Connections between OBServer nodes in a cluster are long connections. Therefore, the communication between them remains unencrypted after you enable encryption. To encrypt the communication between OBServer nodes in an OceanBase cluster, you must restart the cluster.
OceanBase Database supports communication encryption over the SSL/TLS protocol on the data transmission link, as shown in the following figure.
OceanBase Database allows you to specify different SSL authentication modes for different database users. These authentication modes are:
One-way SSL authentication: The OBServer node must provide the CA certificate to the client. During the communication, the client verifies the validity of the CA certificate provided by the OBServer node.
Mutual X.509 authentication: The OBServer node and the client must provide their CA certificate to each other and verify the validity of the certificate from each other.
Special mutual authentication (combinations allowed)
Authentication with a specified encryption algorithm: the mutual X.509 authentication mode with a specified encryption algorithm.
Authentication with a specified issuer: the mutual X.509 authentication mode with a specified issuer of the client CA certificate.
Authentication with a specified SSL subject: the mutual X.509 authentication mode with a specified subject of the client CA certificate.