Azure Database for MariaDB 中的 SSL/TLS 连接SSL/TLS connectivity in Azure Database for MariaDB

Azure Database for MariaDB 支持使用安全套接字层 (SSL) 将数据库服务器连接到客户端应用程序。Azure Database for MariaDB supports connecting your database server to client applications using Secure Sockets Layer (SSL). 通过在数据库服务器与客户端应用程序之间强制实施 SSL 连接,可以加密服务器与应用程序之间的数据流,有助于防止“中间人”攻击。Enforcing SSL connections between your database server and your client applications helps protect against "man in the middle" attacks by encrypting the data stream between the server and your application.

默认设置Default settings

默认情况下,应将数据库服务配置为需要 SSL 连接才可连接到 MariaDB。By default, the database service should be configured to require SSL connections when connecting to MariaDB. 建议尽量不要禁用 SSL 选项。We recommend to avoid disabling the SSL option whenever possible.

通过 Azure 门户和 CLI 预配新的 Azure Database for MariaDB 服务器时,默认情况下会强制实施 SSL 连接。When provisioning a new Azure Database for MariaDB server through the Azure portal and CLI, enforcement of SSL connections is enabled by default.

在某些情况下,应用程序需要具备从受信任的证书颁发机构 (CA) 证书文件生成的本地证书文件才能实现安全连接。In some cases, applications require a local certificate file generated from a trusted Certificate Authority (CA) certificate file to connect securely. 目前,客户只能使用预定义的证书连接到位于 https://dl.cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem 的 Azure Database for MariaDB 服务器。Currently customers can only use the predefined certificate to connect to an Azure Database for MariaDB server which is located at https://dl.cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem.

Azure 门户中显示了各种编程语言的连接字符串。Connection strings for various programming languages are shown in the Azure portal. 这些连接字符串包含连接到数据库所需的 SSL 参数。Those connection strings include the required SSL parameters to connect to your database. 在 Azure 门户中,选择服务器。In the Azure portal, select your server. 在“设置”标题下,选择“连接字符串” 。Under the Settings heading, select the Connection strings. SSL 参数因连接器而异,例如“ssl=true”、“sslmode=require”或“sslmode=required”,以及其他变体。The SSL parameter varies based on the connector, for example "ssl=true" or "sslmode=require" or "sslmode=required" and other variations.

若要了解如何在开发应用程序期间启用或禁用 SSL 连接,请参阅如何配置 SSLTo learn how to enable or disable SSL connection when developing application, refer to How to configure SSL.

Azure Database for MariaDB 中的 TLS 强制执行TLS enforcement in Azure Database for MariaDB

对于使用传输层安全性 (TLS) 连接到数据库服务器的客户端,Azure Database for MariaDB 支持加密。Azure Database for MariaDB supports encryption for clients connecting to your database server using Transport Layer Security (TLS). TLS 是一种行业标准协议,可确保在数据库服务器与客户端应用程序之间实现安全的网络连接,使你能够满足合规性要求。TLS is an industry standard protocol that ensures secure network connections between your database server and client applications, allowing you to adhere to compliance requirements.

TLS 设置TLS settings

Azure Database for MariaDB 提供了为客户端连接强制使用 TLS 版本的功能。Azure Database for MariaDB provides the ability to enforce the TLS version for the client connections. 若要强制执行 TLS 版本,请使用“最低 TLS 版本”选项设置。To enforce the TLS version, use the Minimum TLS version option setting. 此选项设置允许以下值:The following values are allowed for this option setting:

最低 TLS 设置Minimum TLS setting 支持的客户端 TLS 版本Client TLS version supported
TLSEnforcementDisabled(默认值)TLSEnforcementDisabled (default) 不需要 TLSNo TLS required
TLS1_0TLS1_0 TLS 1.0、TLS 1.1、TLS 1.2 及更高版本TLS 1.0, TLS 1.1, TLS 1.2 and higher
TLS1_1TLS1_1 TLS 1.1、TLS 1.2 及更高版本TLS 1.1, TLS 1.2 and higher
TLS1_2TLS1_2 TLS 版本 1.2 及更高版本TLS version 1.2 and higher

例如,将此最低 TLS 设置版本的值设置为 TLS 1.0 意味着服务器将允许使用 TLS 1.0、1.1 和 1.2 + 的客户端进行连接。For example, setting the value of Minimum TLS setting version to TLS 1.0 means your server will allow connections from clients using TLS 1.0, 1.1, and 1.2+. 或者,将此选项设置为 1.2 意味着仅允许使用 TLS 1.2+ 的客户端进行连接,并且将拒绝 TLS 1.0 和 TLS 1.1 的所有连接。Alternatively, setting this to 1.2 means that you only allow connections from clients using TLS 1.2+ and all connections with TLS 1.0 and TLS 1.1 will be rejected.

备注

默认情况下,Azure Database for MariaDB 不会强制执行最低 TLS 版本要求(TLSEnforcementDisabled 设置)。By default, Azure Database for MariaDB does not enforce a minimum TLS version (the setting TLSEnforcementDisabled).

一旦强制实施最低 TLS 版本要求后,以后将无法禁用最低版本强制实施。Once you enforce a minimum TLS version, you cannot later disable minimum version enforcement.

若要了解如何为 Azure Database for MariaDB 设置 TLS 设置,请参阅如何配置 TLS 设置To learn how to set the TLS setting for your Azure Database for MariaDB, refer to How to configure TLS setting.

后续步骤Next steps