Encryption in Transit Add-On

SSL/TLS Encryption in Transit for MySQL, MariaDB and Percona

The built-in SSL/TLS Encrypted Connection add-on protects MySQL, MariaDB, and Percona traffic while data moves between servers. After installation, encryption, endpoint authentication, decryption, and verification are handled automatically.

In this article

Add-On Installation

Open the Add-Ons section for the required MySQL, MariaDB, or Percona layer and click Install for SSL/TLS Encrypted Connection. The package is also available from Marketplace.

MySQL SSL TLS add-on
Install the SSL/TLS Encrypted Connection add-on.

Select the target Environment and Node Group(s). For clustered solutions, select both the MySQL/MariaDB/Percona and ProxySQL layers when ProxySQL is present.

Install MySQL SSL add-on
Select the environment and required node groups.

Click Install. In about a minute, the database is reconfigured to work through an encrypted connection.

SSL add-on installed
The SSL/TLS add-on after successful installation.

Add-On Specifics

Certificates are generated with /usr/local/sbin/selfcertgen. They are self-signed and issued for each individual node hostname, so each node has its own certificate set.

/var/lib/jelastic/keys/SSL-TLS
serverServer certificates used for TLS encryption of database connections.
clientDownloadable client certificates used for client authentication.
SSL add-on certificates
Server and client certificates are stored in the SSL-TLS keys directory.

MySQL / MariaDB / Percona Configuration

/etc/mysql/conf.d/ssl-config.cnf
[mysqld]
ssl_cert=/var/lib/jelastic/keys/SSL-TLS/server/server.crt
ssl_key=/var/lib/jelastic/keys/SSL-TLS/server/server.key
ssl-cipher=ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA
#require_secure_transport=ON

The file defines the server certificate paths and supported ciphers. The require_secure_transport option is commented by default; when enabled, plain non-encrypted connections are rejected.

SSL configuration file
SSL/TLS configuration is stored in ssl-config.cnf.

ProxySQL Configuration

UPDATE global_variables SET variable_value='true' WHERE variable_name='mysql-have_ssl';
LOAD MYSQL VARIABLES TO RUNTIME; SAVE MYSQL VARIABLES TO DISK;
UPDATE mysql_servers SET use_ssl=1 WHERE port=3306;
LOAD MYSQL VARIABLES TO RUNTIME; LOAD MYSQL SERVERS TO RUNTIME; SAVE MYSQL SERVERS TO DISK;

Add-On Configuration

After installation, use Re-issue certificates to generate a new certificate set if certificates are compromised or removed. Use Uninstall to remove the add-on together with its custom configuration and generated certificates.

Configure MySQL SSL add-on
Re-issue certificates or uninstall the add-on.

Secure Connection to MySQL / MariaDB / Percona

Encryption in transit works immediately after installation. For remote access, attach an endpoint or public IP when required.

Database endpoint
Use an endpoint or public IP for remote access when needed.
mysql --ssl-mode=required -h {host} -P {port} -u {user} -p

For the MariaDB client, use --ssl instead of --ssl-mode=required. After connecting, run status and verify the SSL line in the output.

Connect with Client Certificates

Download the client certificates from the target node’s /var/lib/jelastic/keys/SSL-TLS/client directory and connect with:

mysql -h {host} -P {port} -u {user} -p \
--ssl-mode=required \
--ssl-ca={path/to/root.crt} \
--ssl-cert={path/to/client.crt} \
--ssl-key={path/to/client.key}
Node-specific certificates: use the certificate set generated for the exact database node you are connecting to.

Expected Result

The selected database layers use SSL/TLS encryption in transit. Clients can require encrypted sessions, use node-specific client certificates, and re-issue certificates from the add-on when needed.

Important Notes

  • The add-on is supported on MySQL/MariaDB/Percona and ProxySQL layers.
  • Clustered databases should include both database and ProxySQL layers.
  • Certificates are self-signed and node-specific.
  • Certificates are stored under /var/lib/jelastic/keys/SSL-TLS.
  • require_secure_transport=ON can enforce encrypted-only connections.
  • Use --ssl-mode=required with MySQL and --ssl with the MariaDB client.