Server authentication

A database server certificate contains one or more digital signatures used to maintain data integrity and protect against tampering. Following are the steps used to create a digital signature:

An algorithm performed on a certificate generates a unique value or hash.
The hash is encrypted using a signing certificate's or Certificate Authority's private key.
The encrypted hash, called a digital signature, is embedded in the certificate.

A digital signature can be self-signed or signed by an enterprise root certificate or Certificate Authority.

When a client application contacts a database server, and each is configured to use transport-layer security, the server sends the client a copy of its certificate. The client decrypts the certificate's digital signature using the server's public key included in the certificate, calculates a new hash of the certificate, and compares the two values. If the values match, this confirms the integrity of the server's certificate.

If you are using FIPS-certified RSA encryption, you must generate your certificates using RSA.

For more information about self-signed certificates, see Self-signed root certificates.

For more information about enterprise root certificates and Certificate Authorities, see Certificate chains.

When using a globally signed certificate, each client must verify certificate field values to avoid trusting certificates that the same Certificate Authority has signed for other clients. This is resolved by requiring your clients to test the value of fields in the identity portion of the certificate. A Certificate Authority must guarantee the accuracy of the identification information in any certificate that it signs.

For more information about globally signed certificates, see Globally-signed certificates.

When creating a certificate using the createcert utility, you enter values for the organization, organizational unit, and common name fields. You verify these fields using corresponding client connection parameters. It is strongly recommended that you verify certificate fields if you are using a third-party Certificate Authority to globally sign certificates.

Organization The organization field corresponds to the certificate_company encryption protocol option. See certificate_company protocol option.
Organizational unit The organizational unit field corresponds to the certificate_unit encryption protocol option. See certificate_unit protocol option.
Common name The common name field corresponds to the certificate_name encryption protocol option. See certificate_name protocol option.

For more information about client-side encryption connection parameters, see Encryption (ENC) connection parameter.

This is the only required protocol option if TLS is specified in the Encryption connection parameter. Clients use the trusted_certificate encryption protocol option to specify trusted database server certificates. The trusted certificate can be a server's self-signed certificate, a public enterprise root certificate, or a certificate belonging to a commercial Certificate Authority.

Server authentication

Digital signatures

Verifying certificate fields

Using the trusted_certificate protocol option

See also