Skip to content

Commit a637925

Browse files
Oxyjunthomasgauvin
authored andcommitted
PCX review
1 parent 8442a7b commit a637925

File tree

1 file changed

+10
-22
lines changed

1 file changed

+10
-22
lines changed

src/content/docs/hyperdrive/configuration/tls-ssl-certificates-for-hyperdrive.mdx

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -28,18 +28,13 @@ Hyperdrive supports 3 common encryption [TLS/SSL modes](https://www.postgresql.o
2828

2929
- `require` (default): TLS is required for encrypted connectivity and server certificates are validated (based on WebPKI).
3030
- `verify-ca`: Hyperdrive will verify that the database server is trustworthy by verifying that the certificates of the server have been signed by the expected root certificate authority or intermediate certificate authority.
31-
- `verify-full`: Identical to `verify-ca`, but Hyperdrive also requires the database hostname must match a Subject Alternative Name (SAN) present on the certificate.
31+
- `verify-full`: Identical to `verify-ca`, but Hyperdrive also requires the database hostname to match a Subject Alternative Name (SAN) present on the certificate.
3232

33-
By default, all Hyperdrive configurations are encrypted with SSL/TLS (`require`). This requires
34-
that your database is configured to accept encrypted connections (with SSL/TLS).
33+
By default, all Hyperdrive configurations are encrypted with SSL/TLS (`require`). This requires your database to be configured to accept encrypted connections (with SSL/TLS).
3534

36-
You can configure Hyperdrive to use
37-
`verify-ca` and `verify-full` for a more stringent security configuration, which
38-
provide additional verification checks of the server's certificates. This
39-
helps guard against man-in-the-middle attacks.
35+
You can configure Hyperdrive to use `verify-ca` and `verify-full` for a more stringent security configuration, which provide additional verification checks of the server's certificates. This helps guard against man-in-the-middle attacks.
4036

41-
To configure Hyperdrive to verify the certificates of the server, you must provide Hyperdrive with the certificate of the root certificate authority (CA) or an intermediate certificate which
42-
has been used to sign the certificate of your database.
37+
To configure Hyperdrive to verify the certificates of the server, you must provide Hyperdrive with the certificate of the root certificate authority (CA) or an intermediate certificate which has been used to sign the certificate of your database.
4338

4439
### Step 1: Upload your the root certificate authority (CA) certificate
4540

@@ -65,8 +60,7 @@ You must use the CA certificate bundle that is for your specific region. You can
6560

6661
### Step 2: Create your Hyperdrive configuration using the CA certificate and the SSL mode
6762

68-
Once your CA certificate has been created, you can create a Hyperdrive configuration with the newly created
69-
certificates using either the dashboard or Wrangler. You must also specify the SSL mode of `verify-ca` or `verify-full` to use.
63+
Once your CA certificate has been created, you can create a Hyperdrive configuration with the newly created certificates using either the dashboard or Wrangler. You must also specify the SSL mode of `verify-ca` or `verify-full` to use.
7064

7165
<Tabs>
7266

@@ -86,17 +80,15 @@ From the dashboard, follow these steps to create a Hyperdrive configuration with
8680
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/workers/hyperdrive), navigate to **Storage & Databases > Hyperdrive** and click **Create configuration**.
8781
2. Select **Server certificates**.
8882
3. Specify a SSL mode of **Verify CA** or **Verify full**
89-
4. Select the SSL certificate of the certificate authority (CA) of your database that you've previously uploaded with Wrangler.
83+
4. Select the SSL certificate of the certificate authority (CA) of your database that you have previously uploaded with Wrangler.
9084

9185
</TabItem>
9286

9387
</Tabs>
9488

9589

9690

97-
When creating the Hyperdrive configuration, Hyperdrive will attempt to connect to the database with the
98-
provided credentials. If the command provides successful results, you have properly configured your Hyperdrive
99-
configuration to verify the certificates provided by your database server.
91+
When creating the Hyperdrive configuration, Hyperdrive will attempt to connect to the database with the provided credentials. If the command provides successful results, you have properly configured your Hyperdrive configuration to verify the certificates provided by your database server.
10092

10193
:::note
10294

@@ -106,11 +98,9 @@ Hyperdrive will attempt to connect to your database with the provided credential
10698

10799
## Client certificates
108100

109-
Your database can be configured to [verify a certificate provided by the client](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-CLIENTCERT), in this case, Hyperdrive. This serves
110-
as an additional factor to authenticate clients (in addition to the username and password).
101+
Your database can be configured to [verify a certificate provided by the client](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-CLIENTCERT), in this case, Hyperdrive. This serves as an additional factor to authenticate clients (in addition to the username and password).
111102

112-
For the database server to be able to verify the client certificates, Hyperdrive must be configured to provide a certificate
113-
file (`client-cert.pem`) and a private key with which the certificate was generated (`private-key.pem`).
103+
For the database server to be able to verify the client certificates, Hyperdrive must be configured to provide a certificate file (`client-cert.pem`) and a private key with which the certificate was generated (`private-key.pem`).
114104

115105
### Step 1: Upload your client certificates (mTLS certificates)
116106

@@ -157,9 +147,7 @@ From the dashboard, follow these steps to create a Hyperdrive configuration with
157147
</Tabs>
158148

159149

160-
When Hyperdrive will connect to your database, it will provide a client certificate signed with the private key to the database server. This will allow the database server to confirm that the
161-
client, in this case Hyperdrive, has both the private key and the client certificate. By using client certificates, you can add an additional authentication layer for your database that ensures
162-
that only Hyperdrive can connect to it.
150+
When Hyperdrive connects to your database, it will provide a client certificate signed with the private key to the database server. This allows the database server to confirm that the client, in this case Hyperdrive, has both the private key and the client certificate. By using client certificates, you can add an additional authentication layer for your database to ensures that only Hyperdrive can connect to it.
163151

164152
:::note
165153

0 commit comments

Comments
 (0)