Skip to content
Streamkap
Esc
↑↓navigate↵open⌘Jpreview
On this page

SSL certificates for database connections

Identify the SSL certificate and encryption strength your PostgreSQL, MySQL, SQL Server, Oracle, or MongoDB instance uses, and upgrade weak certificates.

It’s possible that your database instance is using outdated or weak SSL certificates for encrypted connections. Your Sources and Destinations in Streamkap may be affected if they connect to databases with weak SSL certificates. In such cases, you may see connection errors or warnings in the Streamkap UI and logs indicating SSL/TLS issues or encryption algorithm problems, such as:

  • “Certificate verify failed”
  • “SSL handshake failed due to weak encryption algorithm”
  • “Certificates do not conform to algorithm constraints”

Before You Begin

Prerequisites

  1. Backup: Create backups of existing certificates and database configuration
  2. Downtime Planning: Schedule maintenance window for certificate updates
  3. Certificate Preparation: Ensure new certificates are ready:
    • Server certificate (.crt or .pem)
    • Private key (.key or .pem)
    • CA certificate chain (optional but recommended)
  4. Permission Check: Verify you have necessary permissions to modify database configuration

Common Certificate Types and Their Security

Key Type Key Size Hash Algorithm Security Level Recommendation
RSA 2048-bit SHA-256 Good Acceptable for most use cases
RSA 4096-bit SHA-256 Strong Recommended for high security
RSA 1024-bit SHA-1 Weak Should be upgraded
ECDSA P-256 SHA-256 Good Modern alternative to RSA
ECDSA P-384 SHA-384 Strong High security

PostgreSQL

Check certificate using openssl:

openssl s_client -connect {hostname}:5432 -starttls postgres < /dev/null 2>/dev/null | openssl x509 -text -noout

Check certificate encryption using SQL:

SHOW ssl;
SHOW ssl_cert_file;
SHOW ssl_key_file;
SHOW ssl_ca_file;
SELECT ssl, version, cipher, bits FROM pg_stat_ssl WHERE pid = pg_backend_pid();

Self-hosted PostgreSQL

Self-hosted PostgreSQL certificate documentation:

AWS RDS PostgreSQL

AWS RDS manages certificates, so typically no action is needed.

PostgreSQL on AWS RDS certificate documentation:

Azure Database for PostgreSQL

Azure manages certificates, so typically no action is needed.

Azure PostgreSQL certificate documentation:

Google Cloud SQL PostgreSQL

Google Cloud SQL manages certificates, so typically no action is needed.

Cloud SQL PostgreSQL certificate documentation:

MySQL / MariaDB

Check certificate using openssl:

openssl s_client -connect {hostname}:3306 -starttls mysql < /dev/null 2>/dev/null | openssl x509 -text -noout

Check certificate encryption using SQL:

SHOW STATUS LIKE 'Ssl_cipher';

Self-hosted MySQL/MariaDB

Self-hosted MySQL/MariaDB certificate documentation:

AWS RDS MySQL/MariaDB

MySQL/MariaDB on AWS RDS manages certificates, so typically no action is needed.

MySQL/MariaDB on AWS RDS certificate documentation:

Azure Database for MySQL

Azure manages certificates, so typically no action is needed.

Azure MySQL certificate documentation:

Google Cloud SQL MySQL

Google Cloud SQL manages certificates, so typically no action is needed.

Cloud SQL MySQL certificate documentation:

SQL Server

Check certificate using SQL Server Configuration Manager (Recommended):

  1. Open SQL Server Configuration Manager
  2. Expand SQL Server Network Configuration
  3. Right-click Protocols for [INSTANCE_NAME] → Properties
  4. Navigate to Certificate tab
  5. View the selected certificate from dropdown
  6. Click View to see certificate details (issuer, expiration, key size, signature algorithm)

Check certificate using T-SQL:

-- View certificate details (if using certificate-based authentication)
SELECT issuer_name, subject, expiry_date, key_length FROM sys.certificates;

Examine certificate from Windows Certificate Store:

# View certificates in Local Computer store
Get-ChildItem -Path Cert:\LocalMachine\My | 
    Where-Object {$_.Subject -like "*your-server*"} | 
    Format-List Subject, Issuer, Thumbprint, NotBefore, NotAfter, 
                @{Name="KeySize";Expression={$_.PublicKey.Key.KeySize}},
                SignatureAlgorithm

Self-hosted SQL Server

Microsoft SQL Server certificate documentation:

AWS RDS SQL Server

SQL Server on AWS RDS manages certificates, so typically no action is needed.

SQL Server on RDS certificate documentation:

Azure SQL Database

Azure manages certificates, so typically no action is needed.

Azure SQL certificate documentation:

Oracle

Please refer to official documentation for details on managing Oracle SSL certificates.

Self-hosted Oracle

Oracle certificate documentation:

Oracle Cloud (OCI)

Oracle Cloud OCI certificate documentation:

MongoDB

Please refer to official documentation for details on managing MongoDB SSL certificates.

Self-hosted MongoDB

MongoDB certificate documentation:

MongoDB Atlas

MongoDB Atlas manages certificates, so typically no action is needed.

MongoDB Atlas certificate documentation:

Additional Resources