# Connect to SingleStore using TLS/SSL ## Enable SSL/TLS for a Connection Most client connections are TLS/SSL-enabled by default, even if no parameters are specified. To ensure a TLS/SSL-enabled connection, use either (or both) of the following options: * Use a client side flag, such as `--ssl-mode=REQUIRED` in the MySQL/SingleStore clients. * Use a user created with `REQUIRE SSL`, which enforces SSL on the server side. ## Certificate-Based Authentication For certificate-based authentication: 1. Specify a CA using the [ssl\_ca\_for\_client\_cert](https://docs.singlestore.com/db/v9.1/reference/configuration-reference/engine-variables/list-of-engine-variables.md) engine variable in `memsql.cnf`. The client certificate is verified using this CA. 2. Create a database user with one of the following options in the `CREATE USER` statement to require certificate-based authentication: * `REQUIRE X509`: Enables mutual authentication between the client and SingleStore. The user can connect only if the client presents a valid TLS client certificate that is not expired and chains to the CA bundle configured on the server. Connections that do not provide a valid certificate are rejected. For example: ```sql CREATE USER 's2user'@'%' REQUIRE X509; ``` * `REQUIRE SUBJECT ''`: In addition to extending `REQUIRE X509`, `REQUIRE SUBJECT` checks the subject in the client certificate provided during mTLS connection and enforces that the `Subject DN` in the client certificate must exactly match the configured value. This verifies both trust (via certificate chaining to the CA) and identity (via the `Subject DN` string). For example: ```sql CREATE USER 's2user'@'%' REQUIRE SUBJECT '/CN=s2user/O=example/C=US'; ``` When running `CREATE USER` or `ALTER USER`, specify the `Subject` in [OpenSSL “oneline” format](https://docs.openssl.org/master/man1/openssl-namedisplay-options/). Separate fields, such as `CN`, `O`, `C`, `ST`, and `L`, with a `/`. To generate the `Subject DN` string in OpenSSL "oneline" format, run the following command: ```shell openssl x509 -in client-cert.pem -noout -subject -nameopt compat ``` If the `openssl` output escapes characters inside a DN value, escape each backslash (`\`) in the output because the value is entered as a SQL string literal. For example, if the `Subject` contains `\+`, replace it with `\\+` in the `CREATE USER` or `ALTER USER` statement. For example: ```sql CREATE USER 's2user'@'%' REQUIRE SUBJECT '/O=example/CN=Js3g\\+AF\\+/C=US'; ``` A `Subject` mismatch can return the same generic certificate verification error as CA-chain issues. To troubleshoot, first verify that the client certificate chains to the CA bundle configured on the server (`REQUIRE X509`), and then verify that the `Subject DN` in the certificate exactly matches the configured `REQUIRE SUBJECT` value. Users configured with `REQUIRE X509` or `REQUIRE SUBJECT` can authenticate using their TLS client certificate instead of a database password. This reduces dependency on shared secrets and provides stronger, certificate‑based identity validation. Refer to [CREATE USER](https://docs.singlestore.com/db/v9.1/reference/sql-reference/security-management-commands/create-user.md) for related information. 3. Specify the client certificate and client key while connecting using the `--ssl-cert` and `--ssl-key` client options, respectively. The `VERIFY_CA` option is not required to use TLS/SSL. However, it can be used to prevent sophisticated man-in-the-middle attacks where a would-be attacker can impersonate a server when SSL is disabled or create a secure connection by impersonating a server using an illegitimate server certificate. If this is a concern, then use offline CA files in any SSL connection (not only SingleStore). Refer to [SSL Secure Connections](https://docs.singlestore.com/db/v9.1/security/encryption/ssl-secure-connections.md) for more information. Refer to [The SingleStore JDBC Driver](https://docs.singlestore.com/db/v9.1/developer-resources/connect-with-application-development-tools/connect-with-java-jdbc/the-singlestore-jdbc-driver.md) for details on how to connect using JDBC. ## Generate Client Certificates for SingleStore mTLS Connection Create a client certificate/key pair signed by the CA, and use these files with SingleStore’s `--ssl-cert` and `--ssl-key` options for secure mutual TLS (mTLS) authentication. The CA certificate (`ca-cert.pem`) must also be trusted by the SingleStore cluster configuration for client authentication. ## Prerequisites Install `OpenSSL`. For example, for Ubuntu/Debian: ```shell sudo apt-get install openssl -y ``` ## Create a Certificate Authority (CA) If you already have a CA certificate from your organization or another trusted source, skip this step and use the existing CA to sign the client certificate. The generated CA certificates can be used for local testing. 1. Generate a CA private key: ```shell openssl genrsa -out ca-key.pem 4096 ``` 2. Generate a CA certificate: ```shell openssl req -x509 -new -nodes -key ca-key.pem -sha256 -days 3650 -out ca-cert.pem \  -subj "/C=US/ST=CA/L=SanFrancisco/O=ExampleOrg/OU=IT/CN=Example-CA" ``` You now have: * `ca-key.pem`: The private key for your CA. * `ca-cert.pem`: The public CA certificate. Keep the CA key (`ca-key.pem`) private and secure. Refer to [Certificate-Based Authentication - step 1](https://docs.singlestore.com/#section-id235464539444521.md) for information on how to configure a CA for your cluster. ## Create the Client Certificate and Key 1. Generate the client private key and certificate signing request (CSR) as follows: ```shell openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-req.pem \  -subj "/C=US/ST=CA/L=SanFrancisco/O=ExampleOrg/OU=Client/CN=client.example.com" ``` 2. Create a client certificate signed by the CA. The following command uses the CA’s certificate and key to sign the client’s certificate. ```shell openssl x509 -req -in client-req.pem -CA ca-cert.pem -CAkey ca-key.pem \   -CAcreateserial -out client-cert.pem -days 365 -sha256 ``` You now have: * `client-key.pem`: Client private key. * `client-cert.pem`: Client certificate signed by the CA. ## Verify the Certificates Run the following command to verify that the client certificate is properly signed by the CA: ```shell openssl verify -CAfile ca-cert.pem client-cert.pem ``` An output similar to the following that the client certificate is properly signed by the CA: ```shell client-cert.pem: OK ``` ## Use the Certificates When connecting to SingleStore with mTLS, specify the client certificate and key. For example: ```shell singlestore -u user \ --ssl-ca=/path/to/ca.pem \ --tls-version=TLSv1.2 \ --ssl-cert=/path/to/client-cert.pem \     --ssl-key=/path/to/client-key.pem ``` Ensure the SingleStore server is configured with server certificate and key before running this command. *** Modified at: June 12, 2026 Source: [/db/v9.1/connect-to-singlestore/connect-to-singlestore-using-tls-ssl/](https://docs.singlestore.com/db/v9.1/connect-to-singlestore/connect-to-singlestore-using-tls-ssl/) (An index of the documentation is available at /llms.txt)