Connecting a springboot application with mysql server over ssl

user_14252594 0
Viewed 2714

I need to connect my spring boot application with a remote my sql server that is on ssl. I am using JPA in my app. I have read about ssl and the certificates required and that I would need MySql Conector/J for establising a conection. I was just wondering what kind of approach I should opt as I am a complete beginner and cant find an effective tuturiol over internet. Any explanation would be highly appreciated.

spring-boot ssl mysql java
2 Answers

The reference is here: https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-reference-configuration-properties.html (Scroll down a bit to security part)

Basically you need a PKCS12 / JKS format of your app's certificate & server CA certificate. Then add it into the JDBC URL.

Example: In application.yml, assume we're using PKCS12 format, use SSL and verify server CA. Assume the client (app) certificate filename is client-cert.p12 and the CA certificate filename is server-ca.p12.

spring:
  datasource:
    url: >
      jdbc:mysql://{DATABASE_IP}/{DATABASE_NAME}?
      useSSL=true&
      requireSSL=true&
      clientCertificateKeyStoreUrl=file://{SOME_DIRECTORY}/client-cert.p12&
      clientCertificateKeyStoreType=PKCS12&
      clientCertificateKeyStorePassword={KEY_STORE_PASSWORD}
      verifyServerCertificate=true&
      trustCertificateKeyStoreUrl=file://{SOME_DIRECTORY}/server-ca.p12&
      trustCertificateKeyStoreType=PKCS12&
      trustCertificateKeyStorePassword={KEY_STORE_PASSWORD}
    username: {USERNAME}
    password: {PASSWORD}

If using JKS, the file format usually is jks and the type is JKS. If you don't need to verify CA, set verifyServerCertificate = false and you don't need the trustCertificateKeyStore stuff (last 3 lines)

user_63399600

If you have managed to get the client certificate, clientkeystore.jks in below expression you can supply the below as the url and can connect:

spring.datasource.url=jdbc:mysql://XXXX:3306/mydatabase?useUnicode=true&characterEncoding=UTF-8&characterSetResults=UTF-8&verifyServerCertificate=true&useSSL=true&requireSSL=true&clientCertificateKeyStoreUrl=file:/opt/clientkeystore.jks&clientCertificateKeyStorePassword=mypass&trustCertificateKeyStoreUrl=file:/opt/truststore.jks&trustCertificateKeyStorePassword=mypass
user_140267880
Related