Java use SSL for database connection

Question

I am currently making a connection to my database without using SSL. I now would like to utilize SSL. The way I have it set up, is my database source is in config.

DB_SOURCE=jdbc:mysql://myDatabaseInfo:3306/DB_NAME?
DB_USER=dbUser
DB_PW=dbPw

I can get the SSL connection to work by calling my program with the following arguments

-Djavax.net.ssl.trustStore=path\to\truststore
-Djavax.net.ssl.trustStorePassword=myPassword

I can also get it to work by changing the env variables in the code itself

dbSource += "?useSSL=true";
System.setProperty("javax.net.ssl.trustStore", "path\to\truststore");  
System.setProperty("javax.net.ssl.trustStorePassword", "myPassword");  
Class.forName("com.mysql.jdbc.Driver");
Connection con = DriverManager.getConnection(dbSource, dbUser, dbPw);

However, my goal is to make the SSL connection without making any changes to my code and without having to change the VM arguments I use. Is there a way I can set my source to include this information?

Something like:

jdbc:mysql://myDatabaseInfo:3306/DB_NAME?useSSL=true&trustCertificateKeyStoreUrl=path\to\truststore&trustCertificateKeyStorePassword=myPassword

I tried this exactly and it doesn't work, ideally I could just add the info to the config I already have so that I don't have to make changes in more than one place. Any ideas?

Tarlog · Accepted Answer · 2012-12-20 20:55:04Z

3

Suggestion 1: put your trust store instead of the java's trust store, or import your certificate into the java's trust store: ${java.home}/lib/security/cacerts

Suggestion 2: Write your own driver extending com.mysql.jdbc.Driver. Put the SSL configuration into the new code. Although you need to code, but not in the main application. Not sure if it's acceptable for you.

answered Dec 20, 2012 at 20:55

Tarlog

10.2k4 gold badges46 silver badges67 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user1514879 Over a year ago

Regarding #1, that only covers the location of the trust store, I would still need the VM argument to set the password, no?

Tarlog Over a year ago

If you import the certificates to the java's default trust store, you don't need to set the password. It's 'changeit' :)

Sigbjørn · Accepted Answer · 2016-05-12 14:24:16Z

0

According to the security section of the MySQLConnector documentation, the trustCertificateKeyStoreUrl takes as input an URL.

That is, you have to prefix it with file: in order to make it work for local files. In other words, you need to set the path to your truststore as file:path\to\truststore.

The same goes for clientCertificateKeyStoreUrl, if you're using that parameter too.

answered May 12, 2016 at 14:24

Sigbjørn

2252 silver badges10 bronze badges

Collectives™ on Stack Overflow

Java use SSL for database connection

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related