Configuring Streams Messaging Manager to connect to TLS/TCPS-enabled databases

Learn how you can configure an existing Streams Messaging Manager service to securely connect to its database using TLS.

Ensure that TLS has already been enabled on the Streams Messaging Manager database.
Ensure that a truststore file containing the database certificate is available on the Streams Messaging Manager hosts. Additionally, ensure that you know the location of the file and that the user running Streams Messaging Manager has access to the file. The default user for Streams Messaging Manager is streamsmsgmgr.

From Cloudera Manager, select Streams Messaging Manager service.
Go to Configuration > Streams Messaging Manager Database JDBC Url Override and enter the following configuration values depending on the database type.
MySQL
```
jdbc:mysql://[***DB HOST***]:[***DB PORT***]/[***DB NAME***]?useSSL=true&trustCertificateKeyStoreUrl=file://[***TRUSTSTORE PATH***]&trustCertificateKeyStoreType=jks&trustCertificateKeyStorePassword=[***TRUSTSTORE PASSWORD***]&enabledTLSProtocols=TLSv<Version>
```
PostgreSQL
```
jdbc:postgresql://[***DB HOST***]:[***DB PORT***]/[***DB NAME***]?useSSL=true&trustCertificateKeyStoreUrl=file://[***TRUSTSTORE PATH***]&trustCertificateKeyStoreType=jks&trustCertificateKeyStorePassword=[***TRUSTSTORE PASSWORD***]&enabledTLSProtocols=TLSv<Version>
```
If your cluster is FIPS-enabled and you need validated FIPS-140-3 compliant PostgreSQL JDBC settings, see Configure FIPS-140-3 compliant PostgreSQL JDBC connections (optional) instead of using this template.
Oracle
```
jdbc:oracle:thin:@tcps://[***DB HOST***]:[***DB PORT***]/[***DB NAME***]?javax.net.ssl.trustStore=[***TRUSTSTORE PATH***]&javax.net.ssl.trustStorePassword=[***TRUSTSTORE PASSWORD***]&oracle.net.ssl_server_dn_match=false
```
- Replace [***DB HOST***], [***DB PORT***], and [***DB NAME***] with the host, port, and name of the database.
- Replace [***TRUSTSTORE PATH***] with the full path to a truststore that contains the database certificate. The truststore must be available on the host that Streams Messaging Manager is deployed on. Additionally, the user that the Streams Messaging Manager service runs as, default is streamsmsgmgr, must have access to the file.
- Replace [***TRUSTSTORE PASSWORD***] with the password used to access the truststore you specify in [***TRUSTSTORE PATH***].
Click Save Changes.
Restart the Streams Messaging Manager service.

The Streams Messaging Manager service establishes a secure connection with its database.

Configure FIPS-140-3 compliant PostgreSQL JDBC connections for Streams Messaging Manager (optional)

Configure optional FIPS-140-3 compliant PostgreSQL JDBC settings for Streams Messaging Manager on FIPS-enabled clusters.

On FIPS-enabled clusters that use a PostgreSQL metadata store, complete the following steps instead of using the PostgreSQL JDBC URL template in step 1.

In Cloudera Manager, select the Streams Messaging Manager service and go to Configuration.
To use a BCFKS truststore for TLS, in SMM JVM Performance Options (SMM_JVM_PERF_OPTS), add the following JVM options:
```
-Djavax.net.ssl.trustStoreType=BCFKS
-Djavax.net.ssl.trustStorePassword=[***TRUSTSTORE PASSWORD***]
-Djavax.net.ssl.trustStore=[***TRUSTSTORE PATH***]
```
To connect by using the Bouncy Castle TLS SSL socket factory, in Streams Messaging Manager Database JDBC Url Override (database_jdbc_url_override), set the following JDBC URL:
```
jdbc:postgresql://[***DB HOST***]:[***DB PORT***]/streamsmsgmgr?sslmode=verify-ca&sslfactory=org.bouncycastle.jsse.provider.SSLSocketFactoryImpl
```
Click Save Changes and restart the Streams Messaging Manager service.

The Streams Messaging Manager service connects to its PostgreSQL metadata store by using FIPS-140-3 compliant JDBC settings.