MariaDB 11.8's zero-configuration TLS requires no manual setup

a year ago by Otto to c/sysadmin

Locking down database access is probably the single most important thing for a system administrator or software developer to prevent their application from leaking its data. As MariaDB 11.8 is the first long-term supported version with a few new key security features, let’s recap what the most important things are every DBA should know about MariaDB in 2025.\n

This is nice for those tired of wrestling with TLS certs and CAs for your database

frongt 10 points a year ago

Connection encryption is pretty low on the list of priorities for database security. Proper accounts and rights management is far more important.

SQL traffic shouldn't really run over anything but short LAN links. Ideally separated from other stuff entirely, but just not spewed over your whole LAN, and really not over the Internet at all.

TLS is good, yes, but unless you're also validating those certs they don't mean much. Client certs would be even better.

save

path: 0 19388821, hotness: undefined, score: 10, children: 3

pcn 5 points a year ago

Some compliance measures (PCI DSS 4, HIPAA) mandate encryption in transit and none penalize it, so making any of that easier and less error-prone seems like a step in the right direction.

save

path: 0 19388821 19393251, hotness: undefined, score: 5, children: 0

otto 3 points a year ago

TLS is good *only' if you are also validating those certs. And that is what MariaDB 11.8 is now doing.

save

path: 0 19388821 19393860, hotness: undefined, score: 3, children: 0

moonpiedumplings 2 points a year ago

The cloud, and any form of managed database, inverts this. User accounts are extremely easy, as they are automatically provisioned with secrets you can easily rotate, along with the database itself. There is less of a worry about user rights as well, as you can dedicate one "instance" of a database to certain types of data, instead of having more than one database within one instance.

And then, traffic is commonly going to be routed through untrusted networks, hence the desire for encryption in transit.

save

path: 0 19388821 19398200, hotness: undefined, score: 2, children: 0