*: update the recent improvements about tls/security #2491

toutdesuite · 2020-05-08T06:24:59Z

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

If you select two or more versions from above, to trigger the bot to cherry-pick this PR to your desired release version branch(es), you must add corresponding labels such as needs-cherry-pick-4.0, needs-cherry-pick-3.1, needs-cherry-pick-3.0, and needs-cherry-pick-2.1.

What is the related PR or file link(s)?

This PR is translated from: *: update the recent improvements about tls/security docs-cn#2417, *: fix typo for reload tls docs-cn#2933, how-to/secure: remove some week cipher suits docs-cn#2998 toc: add alter-instance in toc docs-cn#3068
Other reference link(s):

lysu

LGTM

how-to/secure/enable-tls-clients.md

how-to/secure/enable-tls-between-components.md

TomShawn

The first round of comments.

how-to/secure/enable-tls-between-components.md

TomShawn · 2020-05-12T12:29:41Z

how-to/secure/enable-tls-between-components.md

- The one-way and mutual authentication between the TiDB server and the MySQL Client.
+This section describes how to enable TLS authentication in a TiDB cluster. TLS authentication can be applied to the following scenarios:
+
+- The **mutual authentication** between TiDB components, including the authentication among TiDB, TiKV, and PD, between TiDB Control and TiDB, between TiKV Control and TiKV, between PD Control and PD, between TiKV peers, and between PD peers. Once enabled, the mutual authentication applies to all components, rather than only part of the components.


Suggested change

- The **mutual authentication** between TiDB components, including the authentication among TiDB, TiKV, and PD, between TiDB Control and TiDB, between TiKV Control and TiKV, between PD Control and PD, between TiKV peers, and between PD peers. Once enabled, the mutual authentication applies to all components, rather than only part of the components.

- The **mutual authentication** between TiDB components, including the authentication among TiDB, TiKV, and PD; the authentication between TiDB Control and TiDB, between TiKV Control and TiKV, between PD Control and PD; the authentication between TiKV peers, and between PD peers. Once enabled, the mutual authentication applies to all components, rather than to a part of the components.

TomShawn · 2020-05-13T03:19:41Z

how-to/secure/enable-tls-between-components.md

 > **Note:**
 >
-> The authentication between the MySQL Client and the TiDB server uses one set of certificates, while the authentication among TiDB components uses another set of certificates.
+> The authentication between the MySQL Client and the TiDB server involves one set of certificates, while the authentication among TiDB components uses another set of certificates.


Suggested change

> The authentication between the MySQL Client and the TiDB server involves one set of certificates, while the authentication among TiDB components uses another set of certificates.

> The authentication between the MySQL Client and the TiDB server uses one set of certificates, while the authentication among TiDB components uses another set of certificates.

how-to/secure/enable-tls-between-components.md

TomShawn · 2020-05-13T04:56:55Z

how-to/secure/enable-tls-clients.md

+
+## Reload certificate, key, and CA
+
+When you need to replace the certificate, the key or CA, you can execute the [`ALTER INSTANCE RELOAD TLS`](/reference/sql/statements/alter-instance.md) statement on the running TiDB instance to reload the certificate ([`ssl-cert`](/reference/configuration/tidb-server/configuration-file.md#ssl-cert)), the key ([`ssl-key`](/reference/configuration/tidb-server/configuration-file.md#ssl-key)), and the CA ([`ssl-ca`](/reference/configuration/tidb-server/configuration-file.md#ssl-ca)) from the original configuration path, after replacing the corresponding file. In this case, you do not need to restart the TiDB instance.


Suggested change

When you need to replace the certificate, the key or CA, you can execute the [`ALTER INSTANCE RELOAD TLS`](/reference/sql/statements/alter-instance.md) statement on the running TiDB instance to reload the certificate ([`ssl-cert`](/reference/configuration/tidb-server/configuration-file.md#ssl-cert)), the key ([`ssl-key`](/reference/configuration/tidb-server/configuration-file.md#ssl-key)), and the CA ([`ssl-ca`](/reference/configuration/tidb-server/configuration-file.md#ssl-ca)) from the original configuration path, after replacing the corresponding file. In this case, you do not need to restart the TiDB instance.

To replace the certificate, the key or CA, first replace the corresponding files, then execute the [`ALTER INSTANCE RELOAD TLS`](/reference/sql/statements/alter-instance.md) statement on the running TiDB instance to reload the certificate ([`ssl-cert`](/reference/configuration/tidb-server/configuration-file.md#ssl-cert)), the key ([`ssl-key`](/reference/configuration/tidb-server/configuration-file.md#ssl-key)), and the CA ([`ssl-ca`](/reference/configuration/tidb-server/configuration-file.md#ssl-ca)) from the original configuration path. In this way, you do not need to restart the TiDB instance.

TomShawn · 2020-05-13T04:59:33Z

how-to/secure/enable-tls-clients.md

+
+When you need to replace the certificate, the key or CA, you can execute the [`ALTER INSTANCE RELOAD TLS`](/reference/sql/statements/alter-instance.md) statement on the running TiDB instance to reload the certificate ([`ssl-cert`](/reference/configuration/tidb-server/configuration-file.md#ssl-cert)), the key ([`ssl-key`](/reference/configuration/tidb-server/configuration-file.md#ssl-key)), and the CA ([`ssl-ca`](/reference/configuration/tidb-server/configuration-file.md#ssl-ca)) from the original configuration path, after replacing the corresponding file. In this case, you do not need to restart the TiDB instance.
+
+The newly loaded certificate, key, and CA take effect on the connection established after the statement is successfully executed. They have no affect on the connection established before the statement is executed.


Suggested change

The newly loaded certificate, key, and CA take effect on the connection established after the statement is successfully executed. They have no affect on the connection established before the statement is executed.

The newly loaded certificate, key, and CA take effect on the connection that is established after the statement is successfully executed. The connection established before the statement execution is not affected.

TomShawn · 2020-05-13T05:03:10Z

how-to/secure/enable-tls-clients.md

  2. Specify the `--ssl-ca` parameter in the MySQL client.
  3. Specify the `--ssl-mode` to `VERIFY_CA` at least in the MySQL client.
-  4. Make sure that the certificate (`ssl-cert`) configured by the TiDB server is signed by the CA specified by the client `--ssl-ca` parameter, otherwise the authentication fails.
+  4. Make sure that the certificate (`ssl-cert`) configured by the TiDB server is signed by the CA specified by the client `--ssl-ca` parameter; otherwise, the authentication fails.


Suggested change

4. Make sure that the certificate (`ssl-cert`) configured by the TiDB server is signed by the CA specified by the client `--ssl-ca` parameter; otherwise, the authentication fails.

4. Make sure that the certificate (`ssl-cert`) configured in the TiDB server is signed by the CA specified by the client `--ssl-ca` parameter; otherwise, the authentication fails.

TomShawn · 2020-05-13T05:08:40Z

how-to/secure/enable-tls-clients.md


 - To perform mutual authentication, meet both of the above requirements.

+By default, you can choose to authenticate the client from the server. Even if the client does not present its certificate of identification during the TLS handshake, the TLS connection can be established. You can also require the client to be authenticated through `require 509` when creating a user (`create user`), granting permissions (`grant`), or modifying an existing user (`alter user`). The following is an example of creating a user:


Suggested change

By default, you can choose to authenticate the client from the server. Even if the client does not present its certificate of identification during the TLS handshake, the TLS connection can be established. You can also require the client to be authenticated through `require 509` when creating a user (`create user`), granting permissions (`grant`), or modifying an existing user (`alter user`). The following is an example of creating a user:

By default, the server-to-client authentication is optional. Even if the client does not present its certificate of identification during the TLS handshake, the TLS connection can be still established. You can also require the client to be authenticated by specifying `require 509` when creating a user (`create user`), granting permissions (`grant`), or modifying an existing user (`alter user`). The following is an example of creating a user:

TomShawn · 2020-05-13T06:01:36Z

how-to/secure/enable-tls-clients.md

 > **Note:**
 >
-> Currently, it is optional that TiDB server authenticates the client. If the client does not present its identity certificate in the TLS handshake, the TLS connection can also be successfully established.
+> If the logged-in user has been configured to verify the user certificate using the [TiDB Certificate-Based Authentication for Login] (/reference/security/cert-based-authentication.md#configure-the-user-certificate-information-for-login-verification), the user is implicitly required to enable the encrypted connection to TiDB.


@lysu Please confirm whether 如果登录用户已配置使用 TiDB 证书鉴权功能校验用户证书 means If the logged-in user has configured using the TiDB Certificate-Based Authentication for Login, thanks!

maybe we should remove "ed" from "logged-in user"? yes， you means we need "如果登录用户已配置使用 TiDB 证书鉴权功能校验用户证书" instead of "如果已登录用户已配置使用 TiDB 证书鉴权功能校验用户证书"？

@lysu I will update logged-in user later. But Tom wants to confirm whether 如果登录用户已配置使用 TiDB 证书鉴权功能校验用户证书 means If the logged-in user has configured using the TiDB Certificate-Based Authentication for Login. Here the Chinese version is slightly different from the English version~ The English version omits 校验用户证书, since 校验用户证书 is implicit in the sentence

emmm~ I agree with you, we can omits "校验用户证书" :D

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

toutdesuite · 2020-05-13T10:13:58Z

@TomShawn Comments addressed. PTAL, thanks

reference/sql/statements/alter-instance.md

reference/tools/tidb-control.md

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

TomShawn

LGTM

sre-bot · 2020-05-13T10:32:56Z

/run-all-tests

sre-bot · 2020-05-13T10:47:17Z

cherry pick to release-3.1 in PR #2548

sre-bot · 2020-05-13T10:48:09Z

cherry pick to release-4.0 in PR #2549

toutdesuite added 3 commits May 8, 2020 14:24

update security

b7efc18

minor changes

3cc95d7

Update enable-tls-between-components.md

7169fe9

toutdesuite added needs-cherry-pick-3.1 translation/from-docs-cn This PR is translated from a PR in pingcap/docs-cn. v4.0 This PR/issue applies to TiDB v4.0. labels May 8, 2020

toutdesuite marked this pull request as draft May 8, 2020 12:37

toutdesuite added 4 commits May 8, 2020 20:40

Update enable-tls-clients.md

dabd6a2

Merge branch 'master' into update-security

70448b4

fix dead link

35067aa

Merge branch 'master' into update-security

13b744c

toutdesuite marked this pull request as ready for review May 8, 2020 13:28

toutdesuite requested review from TomShawn and lysu May 8, 2020 13:37

lysu approved these changes May 9, 2020

View reviewed changes

how-to/secure/enable-tls-clients.md Outdated Show resolved Hide resolved

TomShawn reviewed May 9, 2020

View reviewed changes

how-to/secure/enable-tls-between-components.md Outdated Show resolved Hide resolved

TomShawn and others added 2 commits May 9, 2020 15:31

Update how-to/secure/enable-tls-between-components.md

1c62919

Update enable-tls-clients.md

a5c2fad

TomShawn reviewed May 13, 2020

View reviewed changes

toutdesuite and others added 5 commits May 13, 2020 16:56

Update how-to/secure/enable-tls-between-components.md

75ed09d

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Update how-to/secure/enable-tls-between-components.md

aa2d976

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

address comments

b3abcea

add ALTER INSTANCE to TOC

a35d9fb

resolve comments

49db34f

TomShawn reviewed May 13, 2020

View reviewed changes

toutdesuite and others added 3 commits May 13, 2020 18:18

Update reference/sql/statements/alter-instance.md

535927d

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Update reference/tools/tidb-control.md

b86aa43

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Update reference/tools/tidb-control.md

31b509a

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

toutdesuite and others added 4 commits May 13, 2020 18:19

Update reference/tools/tidb-control.md

c347cc4

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Update reference/sql/statements/alter-instance.md

bcb9a7e

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Update reference/sql/statements/alter-instance.md

3c973a2

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Update reference/sql/statements/alter-instance.md

e9bef47

Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

TomShawn approved these changes May 13, 2020

View reviewed changes

TomShawn added the status/can-merge Indicates a PR has been approved by a committer. label May 13, 2020

Merge branch 'master' into update-security

9719c23

TomShawn added status/can-merge Indicates a PR has been approved by a committer. and removed status/can-merge Indicates a PR has been approved by a committer. labels May 13, 2020

sre-bot merged commit 1d201f7 into pingcap:master May 13, 2020

sre-bot pushed a commit to sre-bot/docs that referenced this pull request May 13, 2020

*: update the recent improvements about tls/security (pingcap#2491)

b014f1f

sre-bot mentioned this pull request May 13, 2020

*: update the recent improvements about tls/security (#2491) #2548

Merged

5 tasks

sre-bot pushed a commit to sre-bot/docs that referenced this pull request May 13, 2020

*: update the recent improvements about tls/security (pingcap#2491)

8b584f6

sre-bot mentioned this pull request May 13, 2020

*: update the recent improvements about tls/security (#2491) #2549

Merged

5 tasks

sre-bot added a commit that referenced this pull request May 13, 2020

*: update the recent improvements about tls/security (#2491) (#2548)

db6ac98

sre-bot added a commit that referenced this pull request May 13, 2020

*: update the recent improvements about tls/security (#2491) (#2549)

46c28e5

XiaoGe2030 mentioned this pull request Sep 2, 2020

Fix a typo about enabling tls #3801

Merged

5 tasks

	- The mutual authentication between TiDB components, including the authentication among TiDB, TiKV, and PD, between TiDB Control and TiDB, between TiKV Control and TiKV, between PD Control and PD, between TiKV peers, and between PD peers. Once enabled, the mutual authentication applies to all components, rather than only part of the components.
	- The mutual authentication between TiDB components, including the authentication among TiDB, TiKV, and PD; the authentication between TiDB Control and TiDB, between TiKV Control and TiKV, between PD Control and PD; the authentication between TiKV peers, and between PD peers. Once enabled, the mutual authentication applies to all components, rather than to a part of the components.

	> The authentication between the MySQL Client and the TiDB server involves one set of certificates, while the authentication among TiDB components uses another set of certificates.
	> The authentication between the MySQL Client and the TiDB server uses one set of certificates, while the authentication among TiDB components uses another set of certificates.


		## Reload certificate, key, and CA

		When you need to replace the certificate, the key or CA, you can execute the [`ALTER INSTANCE RELOAD TLS`](/reference/sql/statements/alter-instance.md) statement on the running TiDB instance to reload the certificate ([`ssl-cert`](/reference/configuration/tidb-server/configuration-file.md#ssl-cert)), the key ([`ssl-key`](/reference/configuration/tidb-server/configuration-file.md#ssl-key)), and the CA ([`ssl-ca`](/reference/configuration/tidb-server/configuration-file.md#ssl-ca)) from the original configuration path, after replacing the corresponding file. In this case, you do not need to restart the TiDB instance.


		When you need to replace the certificate, the key or CA, you can execute the [`ALTER INSTANCE RELOAD TLS`](/reference/sql/statements/alter-instance.md) statement on the running TiDB instance to reload the certificate ([`ssl-cert`](/reference/configuration/tidb-server/configuration-file.md#ssl-cert)), the key ([`ssl-key`](/reference/configuration/tidb-server/configuration-file.md#ssl-key)), and the CA ([`ssl-ca`](/reference/configuration/tidb-server/configuration-file.md#ssl-ca)) from the original configuration path, after replacing the corresponding file. In this case, you do not need to restart the TiDB instance.

		The newly loaded certificate, key, and CA take effect on the connection established after the statement is successfully executed. They have no affect on the connection established before the statement is executed.

	4. Make sure that the certificate (`ssl-cert`) configured by the TiDB server is signed by the CA specified by the client `--ssl-ca` parameter; otherwise, the authentication fails.
	4. Make sure that the certificate (`ssl-cert`) configured in the TiDB server is signed by the CA specified by the client `--ssl-ca` parameter; otherwise, the authentication fails.


		- To perform mutual authentication, meet both of the above requirements.

		By default, you can choose to authenticate the client from the server. Even if the client does not present its certificate of identification during the TLS handshake, the TLS connection can be established. You can also require the client to be authenticated through `require 509` when creating a user (`create user`), granting permissions (`grant`), or modifying an existing user (`alter user`). The following is an example of creating a user:

*: update the recent improvements about tls/security #2491

*: update the recent improvements about tls/security #2491

Uh oh!

Conversation

toutdesuite commented May 8, 2020 • edited by TomShawn Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

Uh oh!

lysu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TomShawn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

toutdesuite May 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

toutdesuite commented May 13, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TomShawn left a comment

Choose a reason for hiding this comment

Uh oh!

sre-bot commented May 13, 2020

Uh oh!

sre-bot commented May 13, 2020

Uh oh!

sre-bot commented May 13, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

toutdesuite commented May 8, 2020 •

edited by TomShawn

Loading

toutdesuite May 13, 2020 •

edited

Loading