SSL
By default, YugabyteDB transmits data between the server and clients without encrypting it. This is generally acceptable when the server and client run on the same host or in networks where security is guaranteed through other means. However, in cases where the server and client exist on separate networks or they are in a high-risk network, the lack of encryption does introduce security concerns as a malicious actor could potentially eavesdrop on the traffic as it is sent over the network between them.
To mitigate this concern, YugabyteDB allows you to encrypt data in transit between the server and clients using the Transport Layer Security (TLS) protocol. TLS was formerly known as Secure Socket Layer (SSL), but strictly speaking the SSL protocol is a predecessor to TLS and, that version of the protocol is now considered insecure. The documentation still uses the term SSL often and for compatibility reasons TLS-related server system
In order to secure connections between the server and client, you need to ensure that your server was compiled with TLS support.
For a connection to be known SSL-secured, SSL usage must be configured on both the client and the server before the connection is made. If it is only configured on the server, the client may end up sending sensitive information (e.g., passwords) before it knows that the server requires high security. All SSL options carry overhead in the form of encryption and key-exchange, so there is a trade-off that has to be made between performance and security. You will find more information on this page.
Communication with YugabyteDB can be set with any of these SSL modes:
Depending on the setup, one or more of the following fields will need to reference the appropriate file:
Certificate Authority
For production use, your PostgreSQL deployment should use valid certificates generated and signed by a single certificate authority. You or your organization can generate and maintain an independent certificate authority, or use certificates generated by a third-party SSL vendor.
To verify the identity of the PostgreSQL deployment you connect to, provide one or more certificates of trusted Certificate Authorities.