Configure mTLS for SingleStore Kafka Sink Connector

Generate Client Certificates

Refer to Generate Client Certificates for SingleStore mTLS Connection for information on generating the required certificates for mTLS authentication.

The following files are generated:

• ca-key.pem: The private key for the CA.

• ca-cert.pem: The public CA certificate.

• client-key.pem: The client private key.

• client-cert.pem: The client certificate signed by the CA.

Additionally, download the singlestore_bundle.pem certificate file.

Create a Java Keystore

The connector uses the SingleStore JDBC driver internally, which expects the client certificate and key in a keystore format. Convert the .pem files to a .p12 keystore using OpenSSL. Update the certificate files paths, and then run the following command:

openssl pkcs12 -export \
  -inkey /path/to/client-key.pem \
  -in /path/to/client-cert.pem \
  -out client-keystore.p12 \
  -name client-cert \
  -CAfile /path/to/ca-cert.pem \
  -caname root \
  -passout pass:<your_keystore_password>

This command creates a client-keystore.p12 file that contains the client certificate, private key, and CA certificate chain, protected by the keystore password (<your_keystore_password>).

Copy and securely store the client-keystore.p12 file.

Configure SingleStore

Configure a CA in your SingleStore Self-Managed cluster:

1. Copy the ca-cert.pem file to the same path on each host running aggregator nodes in the cluster.

2. Run the following command to configure the CA bundle (ca-cert.pem file) using the ssl_ca_for_client_cert engine variable (update the path before running the command):

   Shell

   Copy

   sdb-admin update-config --role aggregator --key ssl_ca_for_client_cert --value /path/to/ca-cert.pem --all --yes

3. Restart all the nodes in the cluster to apply the changes:

   Shell

   Copy

   sdb-admin restart-node --all --yes

The client certificate is verified using this CA.

Create a Database User

Create a database user with one of the following options in the CREATE USER statement to require certificate-based mTLS authentication (replace <mtls_password> with a secure password):

• REQUIRE X509: The user can connect only if the client presents a valid TLS client certificate that is not expired and chains to the CA bundle configured on the server. Connections that do not provide a valid certificate are rejected. For example:

  SQL

  Copy

  CREATE USER 's2user'@'%' IDENTIFIED BY '<mtls_password>' REQUIRE X509;

• REQUIRE SUBJECT '<subject-dn-string>': In addition to extending REQUIRE X509, REQUIRE SUBJECT enforces that the Subject DN in the client certificate must exactly match the configured value. This option verifies both trust (via certificate chaining to the CA) and identity (via the Subject DN string). For example:

  SQL

  Copy

  CREATE USER 's2user'@'%' IDENTIFIED BY '<mtls_password>' REQUIRE SUBJECT '/CN=s2user/O=example/C=US';

  Note: While running CREATE USER or ALTER USER, the Subject must be specified in OpenSSL “oneline” format. The fields CN, O, C, ST, L, etc., must be separated by a /.

Grant the required privileges to the database user.

Update the Connector Configuration

Update the following parameters in the SingleStore Kafka Sink connector's configuration JSON to enable mTLS authentication:

• connection.user: Specify the username of the mTLS-enabled SingleStore database user.

• connection.password: Specify the password (<mtls_password>) for the SingleStore database user.

• params.sslMode: Specify either of the following:

  • verify-ca: Use SSL/TLS for encryption and perform certificate verification, but do not perform hostname verification.

  • verify-full: Use SSL/TLS for encryption, certificate verification, and hostname verification.

  Refer to sslMode for more information.

• params.serverSslCert: Specify the path to singlestore_bundle.pem (include the filename and extension).

• params.keyStore: Specify the path to client-keystore.p12 (include the filename and extension).

• params.keyStorePassword: Specify the keystore password (<your_keystore_password>) passed to the openssl command.

• params.keyStoreType. Specify PKCS12 as the keystore type.

Refer to SingleStore JDBC Driver - TLS Parameters for more information on supported SSL/TLS configuration options.

The following is a sample configuration:

{
  "name": "singlestore-sink-connector-mtls",
  "config": {
    "connector.class": "com.singlestore.kafka.SingleStoreSinkConnector",
    "tasks.max": "1",
    "topics": "s2Ingest",

    "connection.clientEndpoint": "svc-XXXX-svchost:3306",
    "connection.database": "dbTest",

    "connection.user": "mtls_user",
    "connection.password": "<mtls_password>",

    "params.sslMode": "verify-full",
    "params.serverSslCert": "/opt/certs/singlestore_bundle.pem",
    "params.keystore": "/opt/certs/client-keystore.p12",
    "params.keyStorePassword": "<keystore_password>",
    "params.keyStoreType": "PKCS12"
  }
}

To apply the configuration, deploy or restart the connector.