Description:

DigitalOcean Managed Databases support encrypted connections using SSL/TLS. Database connections should require SSL/TLS encryption to protect credentials, queries, and data exchanged between applications and the database from interception or modification.


Rationale:

Unencrypted database connections can expose sensitive information to attackers who can intercept network traffic. Enforcing SSL/TLS provides confidentiality and helps protect database credentials and application data in transit.


Impact:

Clients that connect without SSL/TLS will be unable to connect once enforcement is enabled. All applications, scripts, and database clients must therefore be configured to use SSL/TLS.


Default Value:

SSL/TLS support is available for DigitalOcean Managed Databases. The exact enforcement behavior depends on the database engine and configuration. The database's SSL configuration should be explicitly verified rather than assuming that SSL support means SSL is mandatory.


Pre-Requisite:

  1. Log in to DigitalOcean with permission to view and modify database settings.

  2. Identify the Managed Databases that require encrypted connections.

  3. Verify that applications and database clients support SSL/TLS.

  4. Record the existing SSL configuration for backout.


Remediation:

Configure the Managed Database to require SSL/TLS connections and update all clients to connect using SSL/TLS certificates.


Test Plan:

Via DigitalOcean Control Panel

  1. Log in to the DigitalOcean Control Panel.

  2. Go to Databases.

  3. Select the Managed Database.

  4. Open Settings or Configuration.

  5. Review the database SSL/TLS configuration.

  6. Verify that SSL/TLS is enabled and, where supported by the database engine, configured to require encrypted connections.

  7. Verify the database connection details and CA certificate provided by DigitalOcean.

The check passes when database connections are required to use SSL/TLS.


CLI / API

List Managed Databases:

curl -s \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -H "Content-Type: application/json" \
  "https://api.digitalocean.com/v2/databases" | jq

Retrieve a specific database:

curl -s \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -H "Content-Type: application/json" \
  "https://api.digitalocean.com/v2/databases/<database_id>" | jq

Review the database configuration for SSL/TLS-related settings.

For PostgreSQL, for example, the connection should use SSL:

psql "host=<host> port=<port> dbname=<database> user=<user> sslmode=require"


For MySQL:

mysql \

  --host=<host> \

  --port=<port> \

  --user=<user> \

  --password \

  --ssl-mode=REQUIRED


Implementation:

Via DigitalOcean Control Panel

Note: By default, SSL/TLS enforcement is enabled by DigitalOcean


Backout Plan:

Note: By default, SSL/TLS enforcement is enabled by DigitalOcean


References: