Uploaded image for project: 'MariaDB MaxScale'
  1. MariaDB MaxScale
  2. MXS-6383

MaxScale uses TLS to servers that support it, by default

    XMLWordPrintable

Details

    • MXS-SPRINT-268, MXS-SPRINT-269
    • Hide
      If a server is configured with `ssl=allow`, MaxScale uses TLS if server
      supports it, but falls back to unencrypted connections if not.
      See [configuration guide]({maxscale}/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#tls-ssl-encryption)
      for more information.

      `ssl=allow` is the new default value, which means MaxScale defaults to
      encrypted backend connections if available. This can increase CPU usage
      slightly. To disable encryption for backend connections, set `ssl=disable`
      for each server.
      Show
      If a server is configured with `ssl=allow`, MaxScale uses TLS if server supports it, but falls back to unencrypted connections if not. See [configuration guide]({maxscale}/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#tls-ssl-encryption) for more information. `ssl=allow` is the new default value, which means MaxScale defaults to encrypted backend connections if available. This can increase CPU usage slightly. To disable encryption for backend connections, set `ssl=disable` for each server.

    Description

      Would be nice for consistency with listener configuration. For servers, "ssl=allow" means try with SSL but fall back to unencrypted connections if server does not support SSL.

      In the mariadbbackend protocol code, look at the server capabilities to see if SSL is possible. With ConnectorC-based connections, configure SSL but do not check that the final connection is encrypted.

      Server certificates should not be verified unless the relevant settings are enabled. This is different from how the command line client operates (it verifies by default), but verifying certificates by default could cause issues for existing users with older server versions.

      Attachments

        Issue Links

          relates to

          New Feature - A new feature of the product, which has yet to be developed. MXS-5594 A listener can accept both encrypted and unencrypted connections

          • Major - Major loss of function.
          • Closed

          Activity

            People

              esa.korhonen Esa Korhonen
              esa.korhonen Esa Korhonen
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 4d
                  4d

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.