Essential Options
option
description
type
default
JSON or String configuration
Options can be set as a JSON Object, or a using a String.
String format is :
mariadb://[<user>[:<password>]@]<host>[:<port>]/[<db>[?<opt1>=<value1>[&<optx>=<valuex>]]]
example:
Driver permits mapping the logs to an external logger. There are 4 caller functions:
network(string): called for each network exchanges.
query(string): called for each command
error(Error): called for each error.
if setting one function, function will be used for all loggers. (i.e., logger: console.log === logger: { network: console.log, query: console.log, error: console.log})
2 options defined what will be logged : debugLen and logParam. query and network logs are truncated to debugLen length (default to 256). truncated trace finish by '...': example :
Example:
The Connector can encrypt data during transfer using the Transport Layer Security (TLS) protocol. TLS/SSL allows for transfer encryption, and can optionally use identity validation for the server and client.
The term SSL (Secure Sockets Layer) is often used interchangeably with TLS, although strictly-speaking the SSL protocol is the predecessor of TLS, and is not implemented as it is now considered insecure.
There are two different kinds of SSL authentication:
One-Way SSL Authentication: The client verifies the certificate of the server. This allows you to encrypt all exchanges and make sure that you are connecting to the expected server, (to avoid a man-in-the-middle attack).
Two-Way SSL Authentication The client verifies the certificate of the server, the server verifies the certificate of the client. This is also called mutual authentication or client authentication. When using this system, the client also requires a dedicated certificate.
Server Configuration
In order to use SSL, you need to ensure that the MariaDB Server is correctly configured. You can determine this using the have_ssl system variable.
A value of NO indicates that MariaDB was compiled without support for TLS. DISABLED means that it was compiled with TLS support, but it's currently turned off. In order to use SSL with the Connector, the server must return YES, indicating that TLS support is available and turned on. For more information, see the documentation.
User Configuration
Enabling the on the server, the Connector uses one-way SSL authentication to connect to the server. Additionally, it's recommended that you also configure your users to connect through SSL. This ensures that their accounts can only be used with an SSL connection.
For , use the REQUIRE SSL option for one-way SSL authentication and the REQUIRE X509 option for two-way SSL authentication. For more information, see the documentation.
Now when this user attempts to connect to MariaDB without SSL, the server rejects the connection.
ssl: boolean/JSON object.
JSON object:
option
description
type
default
The Connector uses the Node.js implementation of TLS. For more information, see the documentation.
Certificate Validation
By default, Node.js trusts the well-known root Certificate Authorities (CA), based on Mozilla. For a complete list, (including the popular and free Let's Encrypt), see the .
When using a certificate signed with a certificate chain from a root CA known to Node.js, the only configuration you need to do is enable the ssl option.
Certificate Chain Validation
A certificate chain is a list of certificates that were issued from the same Certification Authority hierarchy. In order for any certificate to be validated, all certificates in the chain have to be validated.
In cases where the Connector does not trust intermediate or root certificates, the Connector rejects the connection and issues an error.
Hostname Verification (SNI)
Certificates can provide hostname verification to the driver. By default, this is done against the certificate's subjectAlternativeName DNS name field.
One-way SSL Authentication
When the server certificate is signed using the certificate chain that uses a root CA known in the JavaScript trust store, setting the ssl option enables one-way SSL authentication.
For example,
Since MariaDB 11.4, server supports that permits avoiding having to set any other information than ssl: true.
Previously to this version or using non-MariaDB server, when the server uses a self-signed certificate or uses an intermediate certificate, there are two different possibilities:
In non-production environments, you can tell the Connector to trust all certificates by setting rejectUnauthorized to false. Do NOT use this in production.
A more secure alternative is to provide the certificate chain to the Connector.
Using Specific TLS Protocols or Ciphers
In situations where you don't like the default TLS protocol or cipher or where you would like to use a specific version, you force he Connector to use the one you want using the secureProtocol and cipher options.
For instance, say you want to connect using TLS version 1.2:
For more information on what's available, see values.
Two-way SSL Authentication
Mutual SSL authentication or certificate-based mutual authentication refers to two parties authenticating each other by verifying the provided digital certificates. This allows both parties to be assured of the other's identity. In order to use mutual authentication, you must set the REQUIRE X509 option in the GRANT statement. For instance,
This option causes the server to ask the Connector for a client certificate. If the user is not set with REQUIRE X509, the server defaults to one-way authentication
When using mutual authentication, you need a certificate, (and its related private key), for the Connector as well as the server. If the Connector doesn't provide a certificate and the user is set to REQUIRE X509, the server returns a basic Access denied for user message.
In the event that you would like to see how users are defined, you can find this information by querying the mysql.user table on the server. For instance, say you wanted information on the johnSmith user.
You can test it by creating a user with REQUIRE X509 for testing:
Then use its credentials in your application:
Using Keystores
Keystores allow you to store private keys and certificate chains encrypted with a password to file. For instance, using OpenSSL you can generate a keystore using PKCS12 format:
You can then use the keystore in your application:
option
description
type
default
In some cases, the server is only available through an SSH tunnel. (This is, of course, not a recommended solution for production)
The option stream permit defined a tunnel. stream function has a callback (optional parameters: error, stream).
Example using tunnel-ssh:
error Hostname/IP doesn't match certificate's alt-names
Clients verify certificate SAN (subject alternative names) and CN to ensure that the certificate corresponds to the hostname. If the certificate's SAN/CN does not correspond to the host option, it returns an error such as:
To fix this, correct the host value to correspond to the host identified in the certificate.
routines:ssl_choose_client_version:unsupported protocol
Since Node.js 12, the minimum TLS version is set to 1.2. MariaDB server can be built with many different SSL libraries, the old version supporting only TLS up to 1.1.
The error "1976:error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol" can occur if MariaDB SSL implementation doesn't support TLSv1.2. This can be solved by :
Server side: update MariaDB to a recent version
Client side: permit a lesser version with "tls.DEFAULT_MIN_VERSION = 'TLSv1.1';" or with connection configuration: using option `ssl: { secureProtocol: 'TLSv1_1_method' }'