OneDB v3.5.0

Release Date: July 2026
Release Type: Feature and Security Enhancement Release
Branch: 3.5.0

Overview

OneDB v3.5.0 significantly expands managed database TLS capabilities across all supported database platforms.

This release introduces consistent Certificate Profile management for Microsoft SQL Server, MySQL, MongoDB, Oracle, and PostgreSQL connections. It also strengthens secure listener communication, certificate validation, hostname verification, database migration, and result-set masking.

Additional improvements include a searchable Listener Connection selector, enhanced database connection validation, and multiple runtime stability fixes.

New Features and Enhancements

Managed Backend TLS for Additional Database Platforms

OneDB now provides managed backend TLS for:

  • Microsoft SQL Server
  • MySQL
  • MongoDB
  • Oracle
  • PostgreSQL

Secure database connections can use OneDB Certificate Profiles to manage trusted server certificates through a centralized workflow.

Certificate Profile capabilities include:

  • Fetching certificates directly from database servers
  • Uploading PEM, CRT, or CER certificate files
  • Previewing certificate details
  • Trusting and importing certificates
  • Reusing existing Certificate Profiles
  • Repairing unhealthy profiles
  • Replacing certificates when required
  • Validating Certificate Profile compatibility with the selected database endpoint

Certificate Profiles are matched using the database type, normalized hostname or IP address, and TLS port.

Consistent Secure Database Operations

Managed TLS configuration is now applied consistently across supported database operations, including:

  • Connection Test
  • Database Browser
  • Field Settings discovery
  • Database Migration
  • Runtime connection pooling
  • Startup connection initialization
  • Target database health diagnostics
  • Listener backend connections

This ensures that database connections use the same certificate trust and hostname-verification settings throughout OneDB.

Certificate and Hostname Validation

Secure Connections now support independent certificate-chain and hostname verification.

When hostname verification is enabled, OneDB validates that the database server certificate matches the configured hostname or IP address.

When hostname verification is disabled, OneDB continues validating the trusted certificate chain without performing hostname or IP identity comparison.

OneDB does not use trust-all certificate handling for managed backend TLS connections.

Protocol-Aware Certificate Fetching

OneDB now supports protocol-aware server certificate fetching for database platforms that require database-specific negotiation before starting TLS.

This includes:

  • Microsoft SQL Server TDS PRELOGIN negotiation
  • MySQL SSL Request negotiation
  • PostgreSQL SSLRequest negotiation

This enables OneDB to retrieve database server certificates without requiring database authentication.

Database Hostname Support

Database Connection hosts now support:

  • IPv4 addresses
  • Hostnames
  • Fully Qualified Domain Names
  • localhost

Existing host and endpoint validation remains enforced.

Default Database Port Autofill

The Connection form now automatically suggests the default port for supported database platforms, including:

  • MongoDB: 27017
  • Db2: 50000

Default-port autofill is also available for the existing supported relational database platforms.

Manually entered ports and saved Connection Edit values are preserved.

Searchable Listener Connection Selector

The Listener Add and Listener Edit pages now include a searchable Connection selector.

Connection options are displayed using the following format:

<host>:<port> — <database type> — <connection name>

Administrators can search Connections using:

  • Connection name
  • Hostname or IP address
  • Port
  • Database type

Connections are automatically filtered based on the selected Listener database type. Existing compatible selections are preserved, while incompatible selections are cleared.

Database-Specific Enhancements

Microsoft SQL Server

OneDB now supports managed Microsoft SQL Server backend TLS using Certificate Profiles.

Enhancements include:

  • Managed certificate trust for JDBC and Listener backend connections
  • Optional hostname and IP verification
  • Protocol-aware SQL Server certificate fetching
  • Consistent secure configuration across Browser, Field Settings, Migration, diagnostics, and runtime connections
  • Protection against Additional Connection Properties overriding OneDB-managed TLS settings
  • Improved TLS error handling for certificate trust, expiration, hostname mismatch, and handshake failures

Managed Microsoft SQL Server TLS currently provides server authentication. Managed mutual TLS and client certificates are not included in this release.

MySQL

OneDB now supports managed MySQL backend TLS using Certificate Profiles.

Secure MySQL connections support:

  • Certificate-chain verification
  • Optional hostname and IP verification
  • Managed PKCS12 trust-store configuration
  • Protocol-aware certificate fetching using the MySQL SSL Request flow
  • Managed TLS for Listener backend connections
  • Protection against conflicting TLS options in Additional Connection Properties

Managed MySQL TLS currently provides server authentication. Managed mutual TLS and client certificates are not included in this release.

MongoDB

MongoDB backend TLS is now integrated with OneDB Certificate Profiles.

Enhancements include:

  • Certificate fetch, upload, preview, trust, reuse, repair, and replacement
  • Managed certificate trust for MongoDB client and Listener connections
  • Optional hostname and IP verification
  • Consistent MongoDB client creation across runtime operations
  • Preserved authentication-source handling
  • Preserved SCRAM-SHA-256 and SCRAM-SHA-1 compatibility
  • Improved TLS diagnostics and operational Reference IDs

Oracle

Oracle secure Connections now support managed Certificate Profiles for TCP and TCPS communication.

Enhancements include:

  • Managed certificate trust across Test Connection, Browser, Field Settings, Migration, diagnostics, startup, and Listener connections
  • Support for both SID and Service Name connection modes
  • Optional hostname verification
  • Certificate-chain validation when hostname verification is disabled
  • Removal of the previous trust-all Listener fallback
  • Secure Oracle-to-Oracle migration support

PostgreSQL

OneDB now supports managed PostgreSQL backend TLS using Certificate Profiles.

Enhancements include:

  • Managed certificate-chain validation
  • Optional hostname verification
  • Protocol-aware certificate fetching using PostgreSQL SSLRequest
  • Managed TLS for JDBC and Listener backend connections
  • Protection against conflicting TLS properties
  • Prevention of plaintext fallback when TLS negotiation fails

Managed PostgreSQL TLS currently provides server authentication. Managed mutual TLS and client certificates are not included in this release.

Fixes and Stability Improvements

Microsoft SQL Server TLS

Fixed multiple Microsoft SQL Server TLS negotiation and runtime issues, including:

  • Fragmented network reads during TLS negotiation
  • Multi-packet TDS message handling
  • TLS records containing multiple physical TDS packets
  • Certificate fetching through TDS PRELOGIN
  • Hostname-verification settings not being applied correctly
  • Stale Certificate Profile selections after Connection endpoint changes
  • Inconsistent TLS configuration across database operations
  • Unexpected plaintext fallback after TLS failures

The managed backend TLS Listener was also validated with Microsoft SQL Server Always Encrypted workloads.

MySQL TLS

Fixed inconsistent MySQL TLS behavior across JDBC, Listener, migration, discovery, and runtime connection paths.

The MySQL Listener now validates the configured backend database hostname instead of the Listener bind address.

TLS failures no longer silently downgrade to plaintext connections.

MongoDB TLS

Replaced independent MongoDB client creation and trust-all TLS handling with a shared managed Certificate Profile configuration.

MongoDB Test Connection, Database Browser, Field Settings, Migration, runtime clients, and Listener backend connections now use consistent TLS trust and hostname-verification behavior.

PostgreSQL TLS

Replaced encryption-only PostgreSQL TLS behavior with managed certificate-chain validation.

Fixed PostgreSQL Listener negotiation when the TLS response and initial TLS handshake data arrive in the same network buffer.

TLS negotiation failures and server TLS rejection no longer fall back to plaintext.

Oracle Secure Listener

Fixed secure Oracle Listener negotiation for Oracle TCPS RESEND flows.

Additional fixes include:

  • TLS session recreation during secure RESEND processing
  • Extended Oracle TNS packet-length handling
  • Oracle metadata-response lifecycle handling
  • Result-set fragment processing
  • Result masking for queries containing ROWID and ORA_ROWSCN
  • Multi-row result-set masking stability

Db2 Result-Set Masking

Improved Db2 result-set masking for:

  • Prepared statements
  • Repeated prepared-statement executions
  • Result sets where database metadata is incomplete
  • Nullable UTF-8 VARCHAR values
  • Mixed result layouts in DBeaver Data Grid
  • Queries containing Db2 RID_BIT row-locator columns

Db2 row-locator and timestamp metadata that cannot be safely masked remain pass-through.

Migration Validation

Fixed migration execution so that the saved Create table if not exists option is retained after Preview and job reload.

Migration now requires at least one applicable selected protected field before execution.

Oracle unconstrained NUMBER columns are now preserved correctly without being treated as constrained numeric columns.

Connection and Certificate Profile Validation

Improved Connection save validation for secure and non-secure database Connections.

Fixes include:

  • Resolving submitted Certificate Profile identifiers to existing managed profiles
  • Rejecting missing, unknown, unhealthy, or endpoint-incompatible profiles
  • Clearing stale Certificate Profile associations when TLS is disabled
  • Clearing hostname-verification settings when they are no longer applicable
  • Preventing temporary request-bound Certificate Profile objects from being persisted
  • Preserving Certificate Profiles as independently managed shared entities

Compatibility Notes

PostgreSQL Channel Binding

PostgreSQL clients using SCRAM channel binding must configure:

channel_binding=disable

when connecting through a TLS-terminating OneDB Listener.

The frontend client connection and backend database connection use independent TLS sessions.

Managed Mutual TLS

Managed backend TLS in OneDB v3.5.0 provides database server authentication.

Managed client certificates and mutual TLS are not included for Microsoft SQL Server, MySQL, or PostgreSQL in this release.

Validation Summary

OneDB v3.5.0 was validated across secure and non-secure database scenarios, including:

  • Secure frontend Listener connections
  • Managed backend database TLS
  • Certificate trust validation
  • Hostname and IP verification
  • Database Browser operations
  • Field Settings discovery
  • Result-set masking and tokenization
  • Database Migration
  • Query Audit
  • Query Whitelist processing
  • Runtime connection pooling
  • Database health diagnostics

Validation included supported database clients such as SQL Developer, pgAdmin, DBeaver, VS Code MSSQL, and application-based database connections.