Charmed MySQL Tutorial > 6. Enable TLS encryption
Enable encryption with TLS
Transport Layer Security (TLS) is a protocol used to encrypt data exchanged between two applications. Essentially, it secures data transmitted over a network.
Typically, enabling TLS internally within a highly available database or between a highly available database and client/server applications requires a high level of expertise. This has all been encoded into Charmed MySQL so that configuring TLS requires minimal effort on your end.
TLS is enabled by integrating Charmed MySQL with the Self Signed Certificates Charm. This charm centralises TLS certificate management consistently and handles operations like providing, requesting, and renewing TLS certificates.
In this section, you will learn how to enable security in your MySQL deployment using TLS encryption.
Self-signed certificates are not recommended for a production environment.
Check this guide for an overview of the TLS certificates charms available.
Summary
Enable TLS
To enable TLS on Charmed MySQL, we must deploy the self-signed-certificates charm and integrate it with MySQL.
Deploy TLS charm
Deploy the self-signed-certificates TLS charm with the following command:
juju deploy self-signed-certificates --config ca-common-name="Tutorial CA"
Wait until self-signed-certificates is up and active, using juju status --watch 1s to monitor its progress:
Model Controller Cloud/Region Version SLA Timestamp
tutorial overlord localhost/localhost 2.9.42 unsupported 00:40:42+01:00
App Version Status Scale Charm Channel Rev Exposed Message
mysql 8.0.32-0ubun... active 2 mysql 8.0/stable 147 no
self-signed-certificates active 1 self-signed-certificates edge 77 no
Unit Workload Agent Machine Public address Ports Message
mysql/0* active idle 0 10.234.188.135 Primary
mysql/1 active idle 1 10.234.188.214
self-signed-certificates/1* active idle 6 10.234.188.19
Machine State Address Inst id Series AZ Message
0 started 10.234.188.135 juju-ff9064-0 jammy Running
1 started 10.234.188.214 juju-ff9064-1 jammy Running
6 started 10.234.188.19 juju-ff9064-6 focal Running
Integrate with MySQL
To enable TLS on Charmed MySQL, integrate the two applications:
juju integrate mysql self-signed-certificates
MySQL is now using TLS certificate generated by the self-signed-certificates charm.
Check the TLS certificate in use
Use openssl to connect to MySQL and check the TLS certificate in use:
> openssl s_client -starttls mysql -connect 10.234.188.135:3306 | grep Issuer
...
depth=1 C = US, CN = self-signed-certificates-operator
...
Disable TLS
To remove the external TLS and return to the locally generate one, remove the integration from the applications:
juju remove-relation mysql self-signed-certificates
If you once again check the TLS certificates in use via the OpenSSL client, you will see something similar to the output below:
> openssl s_client -starttls mysql -connect 10.234.188.135:3306 | grep Issuer
...
depth=1 CN = MySQL_Server_8.0.32_Auto_Generated_CA_Certificate
...
The Charmed MySQL application reverted to the placeholder certificate that was created locally during the MySQL server installation.
Next step: 7. Clean up your environment