Configuring TIBCO ActiveMatrix BusinessWorks™ 5 to connect to MySQL database over TLS

This article explains how to configure JDBC Connection shared resource in TIBCO ActiveMatrix BusinessWorks™ 5 to connect to MySQL database over TLS 

Prerequisite

The JDBC driver JAR file (MySQL Connector/J - mysql-connector-j-x.x.x.jar) must be available in bwengine classpath.

JDBC Driver

Select com.mysql.jdbc.Driver from the Select driver dropdown.

Database URL

To enable TLS with mutual authentication, specify the URL as follows -

jdbc:mysql://host:port/database?sslMode=VERIFY_CA&trustCertificateKeyStoreUrl=file:path_to_trust_store&trustCertificateKeyStorePassword=password&clientCertificateKeyStoreUrl=file:path_to_keystore&clientCertificateKeyStorePassword=password

For example,

jdbc:mysql://dbserver:3306/bwdb?sslMode=VERIFY_CA&trustCertificateKeyStoreUrl=file:path_to_trust_store&trustCertificateKeyStorePassword=password&clientCertificateKeyStoreUrl=file:path_to_keystore&clientCertificateKeyStorePassword=password

sslMode - Set this property to VERIFY_CA to enable SSL and verify server certificate
trustCertificateKeyStoreUrl -  Full path to the trust store containing the DB server certificate
trustCertificateKeyStorePassword - Trust store password
clientCertificateKeyStoreUrl - Full path to the keystore containing the client certificate and private key
clientCertificateKeyStorePassword - Keystore password

The trust store and keystore can be specified using the system properties javax.net.ssl.trustStore and javax.net.ssl.keyStore respectively. When using these system properties, specify the URL as follows -

jdbc:mysql://host:port/database?sslMode=VERIFY_CA

Add the following properties to designer.tra/bwengine.tra -

javax.net.ssl.trustStore=path_to_truststore_file
javax.net.ssl.trustStorePassword=truststore_password
javax.net.ssl.keyStore=path_to_keystore_file
javax.net.ssl.keyStorePassword=keystore_password

References

https://dev.mysql.com/doc/connector-j/8.1/en/connector-j-reference-using-ssl.html