Tungsten Clustering

Configure Tungsten<>Database Secure Communication

If you choose to enable database level SSL within your MySQL installation, there are a number of additional steps required to allow the Tungsten Components to be able to communicate to the database layer.

The steps below make the following assumptions:

You have enabled SSL using the correct procedures for your distribution of MySQL. If not, refer to "Enabling Database SSL".
You have generated, and have access to, the client level certificates and keys

If SSL has been enabled within the Tungsten installation, then you should either have the following parameter in your configuration, or it will be omitted altogether since security is enabled by default:

disable-security-controls=false

As a result, you should have a number of files within /opt/continuent/share

shell> ls -l
total 20
-rw-rw-r-- 1 tungsten tungsten  104 Jul 18 10:15 jmxremote.access
-rw-rw-r-- 1 tungsten tungsten  729 Jul 18 10:15 passwords.store
-rw-rw-r-- 1 tungsten tungsten 2268 Jul 18 10:15 tungsten_keystore.jks
-rw-rw-r-- 1 tungsten tungsten 1079 Jul 18 10:15 tungsten_truststore.ts

If you do not have SSL enabled within the installation and you require this, then follow the steps in "Enabling Security" first.
Next, add the following parameters to your installation, but do not run tpm update yet:
```
datasource-enable-ssl=true
```
You now need to convert the mysql client key to PKCS12 format. Adjust the path and filename in the example to suit your environment
```
shell> openssl pkcs12 -export -in /home/tungsten/client-cert.pem \
-inkey /home/tungsten/client-key.pem \
-name mysql -out /home/tungsten/client-key.p12
```
Important
When prompted for a password, you MUST enter tungsten
Important
When using OpenSSL 3.0 with Java 1.8, you MUST add the -legacy option to the openssl command.
Important
If you choose a different alias name rather than mysql shown in the example above, then you must also specify the tpm option java-mysql-alias=youralias in your /etc/tungsten/tungsten.ini

You now need to import the key, either into the existing keystore if it exists, or into a new one if SSL is not being enabled at the replicator level

If Tungsten level SSL has been enabled

shell> keytool -importkeystore -deststorepass tungsten \
-destkeystore /opt/continuent/share/tungsten_keystore.jks \
-srckeystore /home/tungsten/client-key.p12 -srcstoretype PKCS12

If ONLY Database SSL is required

shell> keytool -importkeystore -deststorepass tungsten \
-destkeystore /home/tungsten/tungsten_keystore.jks \
-srckeystore /home/tungsten/client-key.p12 -srcstoretype PKCS12

When prompted for a password, enter tungsten

Next, import the client certificate into the truststore

If Tungsten level SSL has been enabled

shell> keytool -import -alias mysql -trustcacerts -file /home/tungsten/ca.pem \
-keystore /opt/continuent/share/tungsten_truststore.ts

If ONLY Database SSL is required

shell> keytool -import -alias mysql -trustcacerts -file /home/tungsten/ca.pem \
-keystore /home/tungsten/tungsten_truststore.ts

When prompted for a password, enter tungsten

Finally, and only if Tungsten level SSL has been enabled, we need to create backups copies of the keystore and truststore as follows:

shell> cp /opt/continuent/share/tungsten_truststore.ts /opt/continuent/share/.tungsten_truststore.ts.orig
shell> cp /opt/continuent/share/tungsten_keystore.jks /opt/continuent/share/.tungsten_keystore.jks.orig

Issue tpm update to apply the configuration

The replicators will be restarted as part of the update process, and should now be using SSL to connect successfully to MySQL