Skip to content

Commit fa2d4f4

Browse files
qiancaiqiancai
committed
excluded the outdated example code with ljun0712's confirmation
1 parent 906be7e commit fa2d4f4

File tree

1 file changed

+0
-243
lines changed

1 file changed

+0
-243
lines changed

‎tidb-cloud/premium/tidb-cloud-tls-connect-to-premium.md‎

Lines changed: 0 additions & 243 deletions
Original file line numberDiff line numberDiff line change
@@ -38,249 +38,6 @@ In the [TiDB Cloud console](https://tidbcloud.com/), you can get examples of dif
3838
3939
5. Choose your preferred connection method, and then refer to the connection string and sample code on the tab to connect to your instance.
4040

41-
The following examples show the connection strings in MySQL, MyCLI, JDBC, Python, Go, and Node.js:
42-
43-
<SimpleTab>
44-
<div label="MySQL CLI">
45-
46-
MySQL CLI client attempts to establish a TLS connection by default. When you connect to {{{ .premium }}} instances, you need to set `ssl-mode` and `ssl-ca`.
47-
48-
```shell
49-
mysql --connect-timeout 15 --ssl-mode=VERIFY_IDENTITY --ssl-ca=ca.pem --tls-version="TLSv1.2" -u root -h tidb.eqlfbdgthh8.clusters.staging.tidb-cloud.com -P 4000 -D test -p
50-
```
51-
52-
Parameter descriptions:
53-
54-
- With `--ssl-mode=VERIFY_IDENTITY`, MySQL CLI client forces to enable TLS and validate {{{ .premium }}} instances.
55-
- Use `--ssl-ca=<CA_path>` to specify your local path of the downloaded TiDB instance `ca.pem`.
56-
- Use `--tls-version=TLSv1.2` to restrict the versions of the TLS protocol. If you want to use TLS 1.3, you can set the version to `TLSv1.3`.
57-
58-
</div>
59-
60-
<div label="MyCLI">
61-
62-
[MyCLI](https://www.mycli.net/) automatically enables TLS when using TLS related parameters. When you connect to {{{ .premium }}} instances, you need to set `ssl-ca` and `ssl-verify-server-cert`.
63-
64-
```shell
65-
mycli --ssl-ca=ca.pem --ssl-verify-server-cert -u root -h tidb.eqlfbdgthh8.clusters.staging.tidb-cloud.com -P 4000 -D test
66-
```
67-
68-
Parameter descriptions:
69-
70-
- Use `--ssl-ca=<CA_path>` to specify your local path of the downloaded TiDB instance `ca.pem`.
71-
- With `--ssl-verify-server-cert` to validate {{{ .premium }}} instances.
72-
73-
</div>
74-
75-
<div label="JDBC">
76-
77-
[MySQL Connector/J](https://dev.mysql.com/doc/connector-j/en/)'s TLS connection configurations are used here as an example.
78-
79-
After downloading the TiDB instance CA certificate, if you want to import it into your operating system, you can use the `keytool -importcert -alias TiDBCACert -file ca.pem -keystore <your_custom_truststore_path> -storepass <your_truststore_password>` command.
80-
81-
```shell
82-
/* Be sure to replace the parameters in the following connection string. */
83-
/* version >= 8.0.28 */
84-
jdbc:mysql://tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com:4000/test?user=root&password=<your_password>&sslMode=VERIFY_IDENTITY&tlsVersions=TLSv1.2&trustCertificateKeyStoreUrl=file:<your_custom_truststore_path>&trustCertificateKeyStorePassword=<your_truststore_password>
85-
```
86-
87-
You can click **show example usage** to view detailed code examples.
88-
89-
```
90-
import com.mysql.jdbc.Driver;
91-
import java.sql.*;
92-
93-
class Main {
94-
public static void main(String args[]) throws SQLException, ClassNotFoundException {
95-
Class.forName("com.mysql.cj.jdbc.Driver");
96-
try {
97-
Connection conn = DriverManager.getConnection("jdbc:mysql://tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com:4000/test?user=root&password=<your_password>&sslMode=VERIFY_IDENTITY&tlsVersions=TLSv1.2&trustCertificateKeyStoreUrl=file:<your_custom_truststore_path>&trustCertificateKeyStorePassword=<your_truststore_password>");
98-
Statement stmt = conn.createStatement();
99-
try {
100-
ResultSet rs = stmt.executeQuery("SELECT DATABASE();");
101-
if (rs.next()) {
102-
System.out.println("using db:" + rs.getString(1));
103-
}
104-
} catch (Exception e) {
105-
System.out.println("exec error:" + e);
106-
}
107-
} catch (Exception e) {
108-
System.out.println("connect error:" + e);
109-
}
110-
}
111-
}
112-
```
113-
114-
Parameter descriptions:
115-
116-
- Set `sslMode=VERIFY_IDENTITY` to enable TLS and validate {{{ .premium }}} instances.
117-
- Set `enabledTLSProtocols=TLSv1.2` to restrict the versions of the TLS protocol. If you want to use TLS 1.3, you can set the version to `TLSv1.3`.
118-
- Set `trustCertificateKeyStoreUrl` to your custom truststore path.
119-
- Set `trustCertificateKeyStorePassword` to your truststore password.
120-
121-
</div>
122-
123-
<div label="Python">
124-
125-
[mysqlclient](https://pypi.org/project/mysqlclient/)'s TLS connection configurations are used here as an example.
126-
127-
```
128-
host="tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com", user="root", password="<your_password>", port=4000, database="test", ssl_mode="VERIFY_IDENTITY", ssl={"ca": "ca.pem"}
129-
```
130-
131-
You can click **show example usage** to view detailed code examples.
132-
133-
```
134-
import MySQLdb
135-
136-
connection = MySQLdb.connect(host="tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com", port=4000, user="root", password="<your_password>", database="test", ssl_mode="VERIFY_IDENTITY", ssl={"ca": "ca.pem"})
137-
138-
with connection:
139-
with connection.cursor() as cursor:
140-
cursor.execute("SELECT DATABASE();")
141-
m = cursor.fetchone()
142-
print(m[0])
143-
```
144-
145-
Parameter descriptions:
146-
147-
- Set `ssl_mode="VERIFY_IDENTITY"` to enable TLS and validate {{{ .premium }}} instances.
148-
- Use `ssl={"ca": "<CA_path>"}` to specify your local path of the downloaded TiDB instance `ca.pem`.
149-
150-
</div>
151-
152-
<div label="Go">
153-
154-
[Go-MySQL-Driver](https://github.com/go-sql-driver/mysql)'s TLS connection configurations are used here as an example.
155-
156-
```
157-
rootCertPool := x509.NewCertPool()
158-
pem, err := ioutil.ReadFile("ca.pem")
159-
if err != nil {
160-
log.Fatal(err)
161-
}
162-
if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
163-
log.Fatal("Failed to append PEM.")
164-
}
165-
mysql.RegisterTLSConfig("tidb", &tls.Config{
166-
RootCAs: rootCertPool,
167-
MinVersion: tls.VersionTLS12,
168-
ServerName: "tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com",
169-
})
170-
171-
db, err := sql.Open("mysql", "root:<your_password>@tcp(tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com:4000)/test?tls=tidb")
172-
```
173-
174-
You can click **show example usage** to view detailed code examples.
175-
176-
```
177-
package main
178-
import (
179-
"crypto/tls"
180-
"crypto/x509"
181-
"database/sql"
182-
"fmt"
183-
"io/ioutil"
184-
"log"
185-
186-
"github.com/go-sql-driver/mysql"
187-
)
188-
func main() {
189-
rootCertPool := x509.NewCertPool()
190-
pem, err := ioutil.ReadFile("ca.pem")
191-
if err != nil {
192-
log.Fatal(err)
193-
}
194-
if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
195-
log.Fatal("Failed to append PEM.")
196-
}
197-
mysql.RegisterTLSConfig("tidb", &tls.Config{
198-
RootCAs: rootCertPool,
199-
MinVersion: tls.VersionTLS12,
200-
ServerName: "tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com",
201-
})
202-
db, err := sql.Open("mysql", "root:<your_password>@tcp(tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com:4000)/test?tls=tidb")
203-
if err != nil {
204-
log.Fatal("failed to connect database", err)
205-
}
206-
defer db.Close()
207-
208-
var dbName string
209-
err = db.QueryRow("SELECT DATABASE();").Scan(&dbName)
210-
if err != nil {
211-
log.Fatal("failed to execute query", err)
212-
}
213-
fmt.Println(dbName)
214-
}
215-
```
216-
217-
Parameter descriptions:
218-
219-
- Register `tls.Config` in the TLS connection configuration to enable TLS and validate {{{ .premium }}} instances.
220-
- Set `MinVersion: tls.VersionTLS12` to restrict the versions of TLS protocol.
221-
- Set `ServerName: "<host>"` to verify {{{ .premium }}}'s hostname.
222-
- If you do not want to register a new TLS configuration, you can just set `tls=true` in the connection string.
223-
224-
</div>
225-
226-
<div label="Node.js">
227-
228-
[Mysql2](https://www.npmjs.com/package/mysql2)'s TLS connection configurations are used here as an example.
229-
230-
```
231-
var connection = mysql.createConnection({
232-
host: 'tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com',
233-
port: 4000,
234-
user: 'root',
235-
password: '<your_password>',
236-
database: 'test',
237-
ssl: {
238-
ca: fs.readFileSync('ca.pem'),
239-
minVersion: 'TLSv1.2',
240-
rejectUnauthorized: true
241-
}
242-
});
243-
```
244-
245-
You can click **show example usage** to view detailed code examples.
246-
247-
```
248-
var mysql = require('mysql2');
249-
var fs = require('fs');
250-
var connection = mysql.createConnection({
251-
host: 'tidb.srgnqxji5bc.clusters.staging.tidb-cloud.com',
252-
port: 4000,
253-
user: 'root',
254-
password: '<your_password>',
255-
database: 'test',
256-
ssl: {
257-
ca: fs.readFileSync('ca.pem'),
258-
minVersion: 'TLSv1.2',
259-
rejectUnauthorized: true
260-
}
261-
});
262-
connection.connect(function(err) {
263-
if (err) {
264-
throw err
265-
}
266-
connection.query('SELECT DATABASE();', function(err, rows) {
267-
if (err) {
268-
throw err
269-
}
270-
console.log(rows[0]['DATABASE()']);
271-
connection.end()
272-
});
273-
});
274-
```
275-
276-
Parameter descriptions:
277-
278-
- Set `ssl: {minVersion: 'TLSv1.2'}` to restrict the versions of the TLS protocol. If you want to use TLS 1.3, you can set the version to `TLSv1.3`.
279-
- Set `ssl: {ca: fs.readFileSync('<CA_path>')}` to read your local CA path of the downloaded TiDB instance `ca.pem`.
280-
281-
</div>
282-
</SimpleTab>
283-
28441
## Manage root certificates for {{{ .premium }}}
28542

28643
{{{ .premium }}} uses certificates from [AWS Private Certificate Authority](https://aws.amazon.com/private-ca/) as a Certificate Authority (CA) for TLS connections between clients and {{{ .premium }}} instances. Usually, the private key of the CA certificate is stored securely in AWS-managed hardware security modules (HSMs) that meet [FIPS 140-2 Level 3](https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3139) security standards.

0 commit comments

Comments
 (0)