Skip to content

tiny refine cert based authentication #3328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 26, 2020
Merged

tiny refine cert based authentication #3328

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4bd5892
refine cert auth
lysu May 25, 2020
62c7aa1
Merge branch 'docs-special-week' into dev-refine-cert-auth-docs
lysu May 26, 2020
1a73719
Merge branch 'docs-special-week' into dev-refine-cert-auth-docs
May 26, 2020
7a01c51
Merge branch 'docs-special-week' into dev-refine-cert-auth-docs
sre-bot May 26, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 3 additions & 11 deletions certificate-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ category: reference
aliases: ['/docs-cn/dev/reference/security/cert-based-authentication/']
---

# TiDB 证书鉴权使用指南 <span class="version-mark">从 v3.0.8 版本开始引入</span>
# TiDB 证书鉴权使用指南

从 TiDB 3.0.8 版本开始，TiDB 支持基于证书鉴权的登录方式。采用这种方式，TiDB 对不同用户签发证书，使用加密连接来传输数据，并在用户登录时验证证书。相比 MySQL 用户常用的用户名密码验证方式，与 MySQL 相兼容的证书鉴权方式更安全，因此越来越多的用户使用证书鉴权来代替用户名密码验证。
TiDB 支持基于证书鉴权的登录方式。采用这种方式，TiDB 对不同用户签发证书，使用加密连接来传输数据，并在用户登录时验证证书。相比 MySQL 用户常用的用户名密码验证方式，与 MySQL 相兼容的证书鉴权方式更安全，因此越来越多的用户使用证书鉴权来代替用户名密码验证。

在 TiDB 上使用证书鉴权的登录方法，可能需要进行以下操作：

Expand All @@ -20,15 +20,7 @@ aliases: ['/docs-cn/dev/reference/security/cert-based-authentication/']

## 创建安全密钥和证书

### 安装 OpenSSL

目前推荐使用 [OpenSSL](https://www.openssl.org/) 来生成密钥和证书。以 Debian 操作系统为例，先执行以下命令来安装 OpenSSL：

{{< copyable "shell-regular" >}}

```bash
sudo apt-get install openssl
```
目前推荐使用 [OpenSSL](https://www.openssl.org/) 来生成密钥和证书，生成证书的过程和[为 TiDB 客户端服务端间通信开启加密传输](/enable-tls-between-clients.md)过程类似，下面更多演示如何在证书中配置更多需校验的属性字段。

### 生成 CA 密钥和证书

Expand Down