OneDB supports secure connections for MySQL database traffic through the OneDB Listener. This allows MySQL client applications to connect to OneDB using an encrypted connection before the traffic is forwarded to the target MySQL Database.

Secure Connection is useful for environments that require encrypted communication between applications and database access points.

Before You Begin

Before configuring the MySQL client, make sure the following items are already prepared:

1. The MySQL Database connection has been registered in OneDB.
2. The OneDB Listener has been created for the MySQL connection.
3. Secure Connection has been enabled on the OneDB Listener.
4. The listener port is open and reachable from the client machine.
5. The required certificate or trust configuration is available on the MySQL client side, if certificate validation is required.

Listener Configuration in OneDB

In OneDB Web Console, go to the Listener configuration page and create or edit a MySQL listener.

Make sure the following settings are configured:

After saving the listener configuration, start or reload the listener.

MySQL Client Connection Format

For secure MySQL connections, the client should connect to the OneDB Listener using SSL/TLS.

Example using the MySQL command-line client:

mysql \
  --host=onedb-listener-host \
  --port=3307 \
  --user=app_user \
  --password \
  --ssl-mode=REQUIRED

Replace the following values based on your environment:

SSL Mode Options

MySQL supports several SSL modes. The most common options are:

For most secure connection setups through OneDB Listener, use:

--ssl-mode=REQUIRED

For stricter certificate validation, use:

--ssl-mode=VERIFY_CA

Or:

--ssl-mode=VERIFY_IDENTITY

The exact option depends on your organization’s security policy and certificate configuration.

Example Using MySQL Client

Example connection using the MySQL command-line client:

mysql \
  --host=onedb-listener-host \
  --port=3307 \
  --user=app_user \
  --password \
  --ssl-mode=REQUIRED

After connecting, run a simple query:

SELECT 1;

You can also check whether SSL is being used:

SHOW STATUS LIKE 'Ssl_cipher';

If the Ssl_cipher value is not empty, the MySQL client is connected using SSL/TLS.

Example Using JDBC

For Java applications, the MySQL JDBC URL can include SSL parameters.

Example:

jdbc:mysql://onedb-listener-host:3307/app_db?sslMode=REQUIRED

Example Spring Boot configuration:

spring.datasource.url=jdbc:mysql://onedb-listener-host:3307/app_db?sslMode=REQUIRED
spring.datasource.username=app_user
spring.datasource.password=app_password
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver

For stricter certificate validation, the JDBC URL can use:

jdbc:mysql://onedb-listener-host:3307/app_db?sslMode=VERIFY_CA

Or:

jdbc:mysql://onedb-listener-host:3307/app_db?sslMode=VERIFY_IDENTITY

Example Using Application Configuration

Some applications support MySQL connection strings in URL format.

Example:

mysql://app_user:app_password@onedb-listener-host:3307/app_db?sslMode=REQUIRED

For production environments, avoid storing plain text passwords directly in configuration files. Use a secure secret management mechanism when available.

Certificate Configuration

Depending on the selected SSL mode, MySQL clients may require certificate files.

Common client-side certificate files include:

Example using a CA certificate:

mysql \
  --host=onedb-listener-host \
  --port=3307 \
  --user=app_user \
  --password \
  --ssl-mode=VERIFY_CA \
  --ssl-ca=/path/to/ca.pem

Example using identity verification:

mysql \
  --host=onedb-listener-host \
  --port=3307 \
  --user=app_user \
  --password \
  --ssl-mode=VERIFY_IDENTITY \
  --ssl-ca=/path/to/ca.pem

When using VERIFY_IDENTITY, make sure the hostname in the connection string matches the certificate identity.

Testing the Secure Connection

Use the MySQL client to test the secure connection:

mysql \
  --host=onedb-listener-host \
  --port=3307 \
  --user=app_user \
  --password \
  --ssl-mode=REQUIRED

Then run:

SELECT VERSION();

Or:

SELECT 1;

To confirm SSL/TLS is active, run:

SHOW STATUS LIKE 'Ssl_cipher';

Example result:

+---------------+---------------------------+
| Variable_name | Value                     |
+---------------+---------------------------+
| Ssl_cipher    | TLS_AES_256_GCM_SHA384    |
+---------------+---------------------------+

If the Ssl_cipher value is populated, the connection is using SSL/TLS.

Troubleshooting

Unable to connect to the listener

Check that the OneDB Listener is running and the listener port is reachable from the client machine.

telnet onedb-listener-host 3307

Or:

nc -vz onedb-listener-host 3307

SSL connection is not being used

Make sure the client connection uses SSL mode:

--ssl-mode=REQUIRED

Do not use:

--ssl-mode=DISABLED

For JDBC, make sure the connection URL includes:

sslMode=REQUIRED

Certificate validation failed

If you use VERIFY_CA or VERIFY_IDENTITY, check that the CA certificate path is correct and accessible by the client application.

Example:

mysql \
  --host=onedb-listener-host \
  --port=3307 \
  --user=app_user \
  --password \
  --ssl-mode=VERIFY_CA \
  --ssl-ca=/path/to/ca.pem

When using VERIFY_IDENTITY, also make sure the hostname matches the certificate identity.

Application still connects directly to MySQL

Make sure the application database host and port point to the OneDB Listener, not directly to the MySQL Database.

Example:

host=onedb-listener-host
port=3307

Invalid database or user

Make sure the database name and username match the target MySQL Database configuration.

Example:

database=app_db
user=app_user

Summary

MySQL applications can connect securely to the OneDB Listener using SSL/TLS. By enabling Secure Connection on the listener and configuring the MySQL client with the appropriate SSL mode, application traffic to OneDB can be encrypted over the network.

This setup is recommended for environments that require secure database connectivity and stronger protection between applications and database access points.