Product Documentation

Appearance

All platforms

Verifying SSL/TLS Encryption ​

Yellowbrick uses SSL/TLS encryption to protect client communications and passwords, including connections to the management user interface, the front-end PostgreSQL database, and ybtools.

  • Yellowbrick cloud instances require SSL/TLS for all client connections and reject non-SSL connections.
  • Yellowbrick appliances require SSL/TLS for client connections when SSL-only mode is enabled. See Configuration Settings in the SMC.

Connection Prerequisites ​

The database accepts only SSL/TLS connections that use FIPS-approved cryptography. A client must support one of the following:

  • TLS 1.3
  • TLS 1.2 with the Extended Master Secret extension (RFC 7627)

WARNING

If SSL/TLS is not required on the server, a client can connect without encryption instead, without reporting an error. To verify that your clients use SSL/TLS, see Verifying Secure Connections.

Yellowbrick Client Tools ​

  • The client tools for RHEL/CentOS 7, macOS, and Windows include their own OpenSSL 3 library, so they meet these requirements on any supported version of those operating systems.
  • The client tools for other Linux distributions use the OpenSSL library of the operating system. OpenSSL 1.1.1 or later is required, which all supported versions of these distributions provide.
  • The client tools for AIX use the OpenSSL library of the operating system.

Third-Party Clients and Drivers ​

Use clients and drivers that are built with OpenSSL 1.1.1 or later, or with another TLS library that meets the requirements. Clients built with OpenSSL 1.0.2, including the OpenSSL 1.0.2k library of RHEL/CentOS 7, or with the LibreSSL library that macOS provides for its own use, cannot connect.

To check the OpenSSL version of a system, run the openssl version command. For example:

$ openssl version
OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)

The openssl command reports the version of the library it uses itself; a client application might use a different library.

Verifying Secure Connections ​

Administrators can verify that clients are connecting securely by running a query against the sys.session view. For example, this query joins sys.session and sys.user to get the name of users and their secure connection details:

premdb=> select ss.session_id, ss.application_name, ss.user_id, su.name, ss.secure_details
from sys.user su, sys.session ss where su.user_id=ss.user_id and secure_connection = true;
 session_id | application_name | user_id |            name             |                secure_details
------------+------------------+---------+-----------------------------+----------------------------------------------
     93192 | ybsql            |   16399 | trebor@yellowbrickcloud.com | TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384/256 bits
(1 row)