TLS and certificates
DataKlin encrypts PostgreSQL, MySQL and MariaDB connections with TLS. You set it on the Security tab of the connection dialog. Cassandra connections are plaintext only in this release, and SQLite opens a file on your computer, so neither has TLS settings.
Defaults
Section titled “Defaults”- A new connection to a remote host uses Full verification (verify-full): the connection is encrypted, and the server’s certificate must come from a trusted certificate authority (CA) and name the server.
- A new connection to
localhost,127.0.0.1or::1isn’t encrypted. The Security tab says “Your connection is not encrypted.” - Until you pick a mode yourself, a new connection’s mode follows its host: change the host from
localhostto a remote one and the mode becomes Full verification. - Connections saved in DataKlin 0.2.0 or earlier don’t use TLS, and upgrading doesn’t change them. Open the Security tab and choose a TLS mode to encrypt them.
TLS modes
Section titled “TLS modes”The TLS mode field offers the modes the database supports, each with a line on what it protects against. The weaker modes carry a warning icon.
| Mode | What it does |
|---|---|
| Disable | No encryption: anyone on the network path can read and change the traffic, passwords included. |
| Require | Encrypted, but the server’s certificate isn’t verified, so an impostor server goes unnoticed. |
| Verify CA | Encrypted, and the certificate must come from the CA you choose, but it isn’t checked against the host name. |
| Full verification | Encrypted, and the certificate must come from a trusted CA and name the server. Recommended. |
With TLS on, you can also set:
- Minimum TLS version: TLS 1.2 (the default) or TLS 1.3.
- Server name: the name DataKlin checks the server’s certificate against. It’s the connection’s host unless you set it, for example when you reach the server through a forwarded port on
localhost.
Certificates
Section titled “Certificates”CA certificate chooses which certificate authority to trust:
- None: only the root certificates built into DataKlin.
- File: a PEM file, chosen with your system’s file dialog. DataKlin stores its path and reads it when you connect.
- Paste PEM: PEM text, kept in secret storage.
- Amazon RDS CA bundle (built-in): the CA bundle for Amazon RDS and Aurora. See Amazon Aurora and RDS.
With Full verification, the CA you choose is trusted in addition to the built-in root certificates. With Verify CA, it is the only CA trusted, never the public roots, so Verify CA needs one: “Verify CA needs a CA certificate. Choose one, or use Verify full.” With the Amazon RDS bundle, use Full verification, because Verify CA alone accepts the certificate of any RDS endpoint.
Client certificate, for servers that ask for one: a PEM certificate and its PEM private key, as files or pasted text, plus the key’s passphrase if it has one. Pasted certificates, keys and passphrases are kept in secret storage. Each chosen certificate shows its subject, issuer, expiry and SHA-256 fingerprint. DataKlin refuses certificate and key files on network shares or device paths.
On MySQL and MariaDB, a password is sent in cleartext (as AWS IAM tokens need) only over Verify CA or Full verification.
See the connection’s security
Section titled “See the connection’s security”While a console is active, the status bar shows its connection’s TLS state:
- Verified TLS (verify-full) or Verified TLS (verify-ca)
- Encrypted, not verified (require)
- Not encrypted
When a certificate can’t be verified
Section titled “When a certificate can’t be verified”If the TLS handshake fails, the test result or the connection’s error says why: the certificate isn’t trusted, has expired or isn’t valid yet, doesn’t match the host name, the server requires a client certificate, or the server doesn’t support TLS. It explains how to fix it and takes you to the field to change, such as CA certificate or Server name.
There is no “trust anyway” button. A server without TLS and an attacker who strips TLS look the same, so switching to a weaker mode from the error asks you to confirm for any host other than your own computer.
Production connections
Section titled “Production connections”On a connection tagged Production, choosing a weaker TLS mode than the saved one asks for confirmation: you type the connection’s name before Use the weaker mode is enabled. See Read-only and production safety.
Not in this release
Section titled “Not in this release”SSH tunnels, a “prefer” mode (use TLS when the server offers it) and PKCS#12 client certificates are planned for a later release.