Connect to SingleStore Helios using TLS/SSL

Enable SSL/TLS for a Connection

Most client connections are TLS/SSL-enabled by default, even if no parameters are specified. To ensure a TLS/SSL-enabled connection, use either (or both) of the following options:

• Use a client side flag, such as --ssl-mode=REQUIRED in the MySQL/SingleStore clients.

• Use a user created with REQUIRE SSL, which enforces SSL on the server side.

Certificate-Based Authentication

For certificate-based authentication:

1. Configure a CA in the Cloud Portal:

   1. On the left navigation pane, select Workspaces.

   2. Select the three dots for your workspace, and select Access & Security from the list.

   3. On the Security tab, select Upload CA Bundle to upload a CA bundle. The uploaded CA will be used to verify the client certificates when establishing a secure connection.

2. Create a database user with one of the following options in the CREATE USER statement to require certificate-based authentication:

   • REQUIRE X509: The user can connect only if the client presents a valid TLS client certificate that is not expired and chains to the CA bundle configured on the server. Connections that do not provide a valid certificate are rejected. For example:

     SQL

     Copy

     CREATE USER 's2user'@'%' REQUIRE X509;

   • REQUIRE SUBJECT '<subject-dn-string>': In addition to extending REQUIRE X509, REQUIRE SUBJECT enforces that the Subject DN in the client certificate must exactly match the configured value. This option verifies both trust (via certificate chaining to the CA) and identity (via the Subject DN string).

     SQL

     Copy

     CREATE USER 's2user'@'%' REQUIRE SUBJECT '/CN=s2user/O=example/C=US';

     Note: While running CREATE USER or ALTER USER, the Subject must be specified in OpenSSL “oneline” format. The fields CN, O, C, ST, L, etc., must be separated by a /.

   Users configured with REQUIRE X509 or REQUIRE SUBJECT can authenticate using their TLS client certificate instead of a database password. This reduces dependency on shared secrets and provides stronger, certificate‑based identity validation. Refer to CREATE USER for related information.

3. Specify the client certificate and client key while connecting using the --ssl-cert and --ssl-key client options, respectively.

The VERIFY_CA option is not required to use TLS/SSL. However, it can be used to prevent sophisticated man-in-the-middle attacks where a would-be attacker can impersonate a server when SSL is disabled or create a secure connection by impersonating a server using an illegitimate server certificate. If this is a concern, then use offline CA files in any SSL connection (not only SingleStore).

Refer to SingleStore Helios Endpoints for more information.

Refer to The SingleStore JDBC Driver for details on how to connect using JDBC.

Generate Client Certificates for SingleStore mTLS Connection

Create a client certificate/key pair signed by the CA, and use these files with SingleStore’s --ssl-cert and --ssl-key options for secure mutual TLS (mTLS) authentication.

The CA certificate (ca-cert.pem) must also be trusted by the SingleStore workspace configuration for client authentication. In the Cloud Portal, it must be uploaded in the Security tab of the deployment.

sudo apt-get install openssl -y

openssl verify -CAfile ca-cert.pem client-cert.pem

client-cert.pem: OK

mysql -u user \
--ssl-ca=/path/to/ca.pem \
--tls-version=TLSv1.2 \
--ssl-cert=/path/to/client-cert.pem \    	
--ssl-key=/path/to/client-key.pem