Description:

This check verifies that Utho Cloud-managed database connections use transport-layer encryption such as TLS/SSL. Encrypting database traffic protects credentials, queries, and returned data while it travels between applications and database services. All production database connections should require encrypted transport to prevent network-level interception.


Rationale:

Unencrypted database connections can expose sensitive information to attackers who can intercept network traffic.

This check helps:

  • Protect database credentials and application data.

  • Prevent network-level eavesdropping.

  • Reduce the risk of man-in-the-middle attacks.

  • Support security and compliance requirements.


Impact:

  • Protects database traffic while in transit.

  • Prevents unauthorized parties from reading intercepted traffic.

  • Applications using unencrypted database connections may stop working until their connection settings are updated.

  • TLS configuration may require compatible database drivers and connection strings.


Default Value:

Utho Cloud managed databases have SSL/TLS enabled by default. The database is considered compliant when SSL/TLS remains enabled and applications use the SSL-enabled connection configuration.


Pre-requisites:

  • Utho Cloud account.

  • Permissions to view managed database configurations.

  • Access to the Utho Cloud Console or Utho API.

  • At least one Utho managed database instance.


Test Plan:

  1. Sign in to the Utho Cloud Console.

  2. Navigate to Databases.

  3. Select each managed database.

  4. Review the database security or connection settings.

  5. Verify that SSL/TLS is enabled and required.


Using the Utho API:

curl -s -X GET "https://api.utho.com/v2/databases" \
  -H "Authorization: Bearer $UTHO_API_TOKEN" \
  -H "Content-Type: application/json" | jq

Retrieve the configuration of an individual database:

curl -s -X GET "https://api.utho.com/v2/databases/<DATABASE_ID>" \
  -H "Authorization: Bearer $UTHO_API_TOKEN" \
  -H "Content-Type: application/json" | jq

Inspect the database configuration for the TLS/SSL or encrypted-connection setting.


Implementation Plan:

Note: By default, SSL connection has been enabled while creating the database


Using the Utho API:

If the database API exposes a TLS/SSL configuration option, enable the appropriate setting using the supported database configuration endpoint.

curl -s -X GET "https://api.utho.com/v2/databases/190118" \
  -H "Authorization: Bearer $UTHO_API_TOKEN" \
  -H "Content-Type: application/json" | jq 


In the connection string, you can find ssl:1 (boolean number enable)

Backout Plan:

Note: By default, SSL connection has been enabled while creating the database

References: