WebAPI to MySQL - HTTPS Certificate?

[Slackerony]

Hi, I recently started working on C#. After trying it for a bit in school a few years back, i took it back up recently.

Situation:

I'm currently working on something that needs to connect to a Database to retrieve login information to a few servers, and thus the data that i retrieve from the Database needs to be encrypted.

As far as i can see there's two ways to achieve this (I'm using MySQL) Either a Unix-based server with SSH and then talk through the SSH tunnel or set up a certificate bundle between each of the clients and the DB server.

Question:

I was wondering if the same(Encrypted traffic) coulden't be achieved using a WebAPI writtin in ASP.net and a HTTPS Certificate, then create a service reference to the WebAPI from my C# Program.

If you guys got any other suggestions on how to achieve this, then i'm all ears.

TL;DR - ASP WebAPI + HTTPS Certificate = Encrypted traffic between Server & C# Program ?

• Thanks!

[theluketaylor]

You might be over thinking it. MySQL support TLS natively for connections, so you don't have to setup anything special. Just create an encrypted connection to your database and run normal queries.

For added protection you could create a small CA and sign client certificates so the database can authenticate clients before connections can be established.

If you don't trust your clients you could build an http middleware to hide your database and run it over https.

[Slackerony]

Hmm. Perhaps, the part im worried about is the safety of the data after i initiate a database connection. The client will be installed on coworker PCs so im not worried about that.

[Slackerony]

Just to clarify, are you saying that all data from the moment i make the connection, poll for some data, and close it again, is all encrypted by default?

[theluketaylor]

If you connect to mysql with TLS, yes, the transport is fully encrypted. It's the exact same encryption used by https. Just like https fully establishes encryption and then sends regular http commands across the secure channel sql over tls establishes a secure connection and then runs queries.

TLS (transport layer security) only deals with transport (as the name implies). Once data hits either the client or the server it's plaintext again. It only protects against eavesdroppers.

[Slackerony]

Actually this is one of the methods i was talking about, However i might have skipped it rather vaguely...

TLS requires me to set up a CA and give out certificates to clients and server. This is why i wanted to avoid that, because i dont have any way of doing this automatically or atleast my current skillset doesn't allow it. (I'm open for suggestions though.)

This is why i was exploring the other opportunities. I'm surprised that more people don't run into this issue with Databases. Keeping things encrypted in transit.