Set up secure connections to RisingWave with SSL/TLS

RisingWave supports secure connections with TLS/SSL for enhanced client/server communication security.

The terms SSL and TLS are often used interchangeably to mean a secure encrypted connection using a TLS protocol. SSL protocols are the precursors to TLS protocols, and the term SSL is still used for encrypted connections even though SSL protocols are no longer supported. SSL is used interchangeably with TLS in RisingWave.

Configure SSL in RisingWave

When running RisingWave frontend node, set the environment variables RW_SSL_CERT and RW_SSL_KEY to specify the paths of the server-side SSL certificate (typically server.crt) and private key (typically server.key).

Connect to RisingWave using SSL

To connect to RisingWave using SSL, clients can use the psql command with the following parameters:

psql -p 4566 -d dev -h localhost -U root --set=sslmode=verify-full

If the connection is successful, you will see information similar to the following:

SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)

Optional: Create a self-signed certificate for testing purposes

While a self-signed certificate is suitable for testing, it is recommended to obtain a certificate from a Certificate Authority (CA) for production environments.

To create a simple self-signed certificate for the server, valid for 365 days, for testing purposes, use the OpenSSL command below. Replace localhost with the desired Common Name (CN).

openssl req -x509 -sha256 -nodes -newkey rsa:2048 -days 365 -keyout localhost.key -out localhost.crt

After running the command, you will get two files, localhost.crt and localhost.key. You can then set the paths of these files as the values for RW_SSL_CERT and RW_SSL_KEY respectively.