Configuring Data Encryption Options

On the SSL tab, select the Use a secure connection and select an SSL mode to encrypt the connection and data that is transmitted between the SBM components on this server and your database. You enable this setting on a server-by-server basis—you must manually enable it on each server where SSL encryption from SBM to your database is needed. When the Use a secure connection check box is cleared, SSL encryption is not requested or used.

CAUTION:

Enforcing data encryption can negatively impact performance because an SSL handshake is made for each connection to the database.

Review the following sections to configure SSL for either SQL Server or PostgreSQL.

Configuring SSL with SQL Server

Before you begin, you must configure SSL for SQL Server and install a certificate that meets certain requirements. You must also decide if SQL Server will force encryption or not. Refer to "Encrypting Connections to SQL Server" here for details on configuring SQL Server.

To encrypt connections, select Use SSL in SBM, and then select one of the following options:

Authenticate – Selected by default
When this option is selected, SSL encryption is required and the server's certificate must be signed by a trusted certificate authority (CA). Data encryption must be enabled on the server in order to complete the SSL handshake and the client (SBM machine) must trust the root authority of the certificate that is used by the server. This means you must also import trusted root and intermediate certificates into the Windows trust store on all servers in your installation and into the appropriate Java key stores on each SBM Tomcat server to use this option.
Request
When this option is selected, SSL encryption is requested; however, if the server does not support SSL, a plain connection is used. If data encryption is enabled on the server, an SSL handshake is performed; however, the server's certificate is not validated.
Require
When this option is selected, SSL encryption is required; however, if the server does not support SSL, an exception is thrown. If data encryption is enabled on the server, an SSL handshake is performed; however, the server's certificate is not validated.

Important: With the Request and Require options, the server's certificate is not validated and a self-signed certificate is used instead. This means SBM will not check that the certificate is trusted or that its hostname matches the database server host, which exposes the potential for a man-in-the-middle type of attack. Instead, consider using the Authenticate option, which performs certificate validation on each connection and requires the server to have a certificate issued by a trusted authority.

Configuring SSL with PostgreSQL

Before you begin, you must configure SSL for PostgreSQL and install a certificate that meets certain requirements. You must also decide if PostgreSQL will force encryption or not. Refer to "SSL Support" here for details on configuring PostgreSQL.

To connect to PostgreSQL using SSL, select Use a secure connection and select one of the following SSL modes:

Verify Full – Selected by default
When this option is selected, SBM requires an SSL connection to PostgreSQL and verifies that the certificate obtained from the server matches the one in the server.crt file. In addition, the Verify full option checks that the hostname in certificate matches the hostname of the database server.

This is the most secure SSL option.
Verify-CA
When this option is selected, SBM requires an SSL connection PostgreSQL and verifies that the certificate obtained from the server matches the one in the server.crt file.
Require
When this option is selected, SBM requires an SSL connection to PostgreSQL and the connection fails if the PostgreSQL server does not support it.
Prefer
When this option is selected, SBM requests an SSL connection to PostgreSQL, but if the server does not support it, a plain connection is used.
Allow
When this option is selected, SBM can accept an SSL connection from PostgreSQL, but does not require it.

Important: With the Allow, Prefer, and Require options, the server's certificate is not validated and a self-signed certificate is used instead. This means SBM will not check that the certificate is trusted or that its hostname matches the database server host, which exposes the potential for a man-in-the-middle type of attack. Instead, consider using one of the Verify options, which perform certificate validation on each connection and require the server to have a certificate issued by a trusted authority.

You can optionally enable two-way SSL authentication between SBM and PostgreSQL. This forces the client machine (SBM) to identify itself to PostgreSQL in order to complete a secure handshake. To configure this option, perform the following:

Enable and configure SSL in PostgreSQL. In PostgreSQL, ensure that you specify a certificate file that contains all client certificates that will be trusted by the server.
In SBM Configurator, select Use client certificate.
Click Set Client Certificate and enter the location of your certificate file with a private key. The certificate is converted into the following files:

Client certificate file
A PEM-encoded public certificate file.
Client key (ODBC)
A PEM-encoded private key file. Used by IIS, Application Engine, and SBM Configurator.
Client key (JDBC)
A PKCS8 DER-encoded private key. Used by the SBM Java applications.

The certificates are placed in the same folder as the selected certificate with private key, and then used by the ODBC and JDBC drivers when connecting to the PostgreSQL database server.

Configuring Data Encryption Options

Configuring SSL with SQL Server

Configuring SSL with PostgreSQL

Related Topics