Connecting Securely from MC to a Vertica Database
When you use MC to monitor and manage a Vertica database, MC (running in a browser) connects as the client to the Vertica database server.
MC Uses JDBC for Most Database Connections
MC uses Java Database Connectivity (JDBC) for most connections to a Vertica database, including:
- Retrieving database information to display in charts
- Running SQL queries through JDBC
- Configuring and updating database properties
- Configuring the database for extended monitoring
When MC uses Agents to perform AdminTools tasks, MC does not use JDBC to connect to the database.
Vertica Software Supports TLS
Vertica databases and Vertica MC support TLS up to version 1.2. This topic and its subtopics describe configuring TLS in MC for JDBC connections to a Vertica database.
Vertica Database Security Dictates How MC Connects
The TLS/SSL security you configure for a database in MC must be consistent with the security configured on the database itself.
Whether the Vertica database has TLS/SSL configured in server mode or mutual mode, you should configure TLS/SSL for that database in MC to match.
To find out how a Vertica database is configured, see Determining the TLS/SSL Mode of a Vertica Database.
You can configure TLS/SSL in either server mode or mutual mode in MC.
The rest of this topic and related topics use the term TLS, TLS/SSL, and SSL interchangeably.
TLS Server Mode
When the MC client connects to a Vertica database configured in server mode:
- The client requests and verifies the server's credentials.
- The client does not need to present a client certificate and private key file to the server.
The MC administrator must configure the CA certificate that can verify server's certificate on MC when MC connects to the database over JDBC.
TLS Mutual Mode
When the MC client connects to a Vertica database configured in mutual mode:
- The MC client requests and verifies the database server's credentials.
- The server also requests and verifies the MC client's credentials.
- Each MC user is a separate client, and must present a valid client certificate file and private key file pair (keypair), namely a certificate signed by a CA recognized by the Vertica database server as valid.
- The MC administrator must configure:
- The CA certificate to verify the Vertica database server certificate.
- A client certificate and private key file (keypair) for each MC user. The keypair can be unique for each user, or shared by multiple users, depending on how client authentication is configured on the Vertica database. See Implementing Client Authentication.
- Each MC user must be configured to map correctly to a user who is configured on the Vertica database server.
For more information on how Vertica supports TLS/SSL security, see TLS Protocol.
MC Administrator Configures MC Security
Only MC users having Admin, Super, or IT privileges on a database are able to configure TLS certificates and keys on MC for database connections. This topic uses "MC administrator" to refer to these roles. For more information about MC user roles and privileges, see About MC Users.
As the MC administrator, when you first configure security in MC for a Vertica database that requires mutual mode, you configure these certificates for the Vertica database:
- The server certificate and public key of the database.
- Your own client certificate and private key, as the first configured MC user mapped to a Vertica database user.
Configuring TLS/SSL on MC
MC provides the Certificates wizard for configuring TLS certificates for all JDBC connections to the database, to ensure those connections are secure.
In MC, there are three scenarios in which you need to configure TLS security for a Vertica database:
- While you are importing a database to monitor in MC. See Configuring TLS While Importing a Database on MC.
- When you want to add security for a database that is already monitored by MC. See Configuring TLS for a Monitored Database in MC.
- When you need to configure client security for an individual MC user who is mapped to a user who has privileges on the Vertica database server, because the database requires mutual authentication. See Configuring TLS for MC Users, for Mutual Mode.
To Connect Successfully,MC and Database Security Must Match
|MC Security||Vertica Database Security||Does the connection succeed?|
|None||None||Connection succeeds, and it is open and therefore unsecured.|
|TLS server mode||TLS server mode||Connection succeeds provided MC can verify the server's certificate using the CA certificate configured on MC.|
|TLS mutual mode||TLS mutual mode||
Connection succeeds provided:
|None||TLS server mode||
MC attempts to establish an open connection. The connection fails if the Vertica database requires TLS for client connections. For more information, see:
|None||TLS mutual mode||
MC attempts to establish an open connection. The connection fails if the Vertica database requires TLS for client connections. The connection fails because MC does not present what the database requires: a valid client certificate and private key that the database can verify as belonging to a mapped database user.
|TLS server mode||None||MC attempts to connect to the database securely, however the connection fails as the database is not configured with TLS certificates.|
|TLS mutual mode||None||MC attempts to connect to the database securely, however the connection fails as the database is not configured with TLS certificates.|