How to Set Up SSL Certificates for DataSunrise Database Proxy

The majority of databases support verification of server identity by using certificates. Thus a verifying procedure is performed during a connection to a server: if the certificate received from the server is authentic, a connection will be established; otherwise it will be considered as a man-in-the-middle attack. By default, this server certificate check can be enabled / disabled depending on the DBMS. However, we recommend enabling certificate check to keep your data safe.

For a direct connection between a database and a client application, a certificate check works as the follows:

• CA-cert – root certificate of the certification authority,
• Server-key – server private key
• Server-cert – server certificate signed by the CA.

Let’s take a look at MySQL as an example.

The MySQL client is aware of the CA certificate. There are Server-cert and Server-key on the server side. SSL mode can be enabled by the client. The default value of ssl_mode=prefer means that the server certificate authentication is disabled. Also the ssl_mode parameter can be set to:

• Verify-CA (I want my data encrypted and I accept the overhead. I want to be sure that I am connecting to a server I trust)
• Verify-Identity (I want my data encrypted and I accept the overhead. I want to be sure that I am connecting to a server I trust and that it’s the specified one)

Below is an example string used for establishing a direct connection with certificate check:

The following diagram shows the process of establishing a connection with DataSunrise certificate check enabled:

Datasunrise implements the end-to-end encryption functionality in a client-proxy-server chain.

Look at the diagram above: there are two connections. The first connection is established between a client and a DataSunrise proxy. DataSunrise proxy SSL configuration is used for the connection. To set it up, you need to have Proxy-key and Proxy-cert generated and signed by the CA certificate. It enables you to be sure that you are connecting to a genuine DataSunrise proxy.

The second connection is established between a DataSunrise proxy and a database server and its own SSL configuration is used. The DataSunrise proxy works as a client app here and also can verify a connection to an authentic server.

Please note that certificate authentication is an additional option for SSL encryption, it doesn’t work if SSL encryption is disabled.

It is also important that DataSunrise proxy is a transparent proxy and supports the encryption mode that is negotiated by the client and the database server. This means that it is impossible to encrypt only one connection in the chain. Datasunrise proxy can’t receive encrypted traffic from one end and send unencrypted traffic to another end and vice versa.

Here are the steps that enable you to set up an SSL certificate check in DataSunrise:

First connection

1. Navigate to Configuration → SSL Key Groups and click Add Group

2. Input your Proxy-cert and Proxy-key into the corresponding fields. For this, you need to choose the Proxy type.

3. Navigate to Configuration → Databases. Open your database Instance page and click the “pencil” icon to edit proxy settings.

4. Select your SSL Key Group in the Proxy Keys drop-down list and save the settings.

Second connection

1. Navigate to Configuration → SSL Key Group and click Add Group. Select Interface type and input your CA-cert into the CA field.

2. Navigate to Configuration → Databases, select your Instance and click the “pencil” icon to edit interface settings

3. You need to specify the group created in the first step, select certificate verification mode and save the settings.

• Don’t verify – certificate check will not be performed,
• Verify CA only – server’s CA certificate will be verified,
• Verify CA and Identity – server’s CA certificate and server’s hostname in the certificate will be verified.

Having completed the steps above, connecting to a proxy triggers certificate check for the two servers and eliminates the possibility of MITM attacks.