Default TLS Certificate Validation Enabled for Import/Export Queries
Details
| Detail name | Value |
|---|---|
| Changelog Number | 25090 |
| Type | Improvement |
| Status | Resolved |
| Fix Versions | Exasol 2025.1.0 |
| Resolution Date | 2025-07-08 |
Background
Previously, the default behavior of the database was to have TLS certificate validation deactivated for IMPORT and EXPORT queries, leaving connections potentially vulnerable to security risks like man-in-the-middle attacks. Users needed to explicitly enable TLS certificate validation using custom parameters or SQL syntax.
Behavior Update
- TLS Certificate Validation is now activated by default for IMPORT and EXPORT queries, ensuring secure data transfers by validating certificates for external file connections like HTTPS and FTPS.
Manual Control
- To deactivate TLS certificate validation manually:
- Use the database parameter -etlCheckCertsDefault=0. This restores the previous behavior of no certificate validation for external connections.
- Use the IGNORE CERTIFICATE / PUBLIC KEY on SQL query to deactivate certificate validation for the query.
Error Handling
- If TLS certificate validation fails (e.g. missing or untrusted certificate files), users will encounter an error similar to:
SSL certificate problem: unable to get local issuer certificate
Public Key Bypass
- Users can bypass certificate validation by providing a public key explicitly via SQL syntax. This allows more granular control while ensuring secure connections:
IMPORT INTO Test.DB FROM CSV AT 'https://localhost:8511/' PUBLIC KEY 'sha256//<key>' FILE 'Test.csv';
Impact
- Security Improvement: Enhanced default security for external file connections.
- Backward Compatibility: This change results in a behavior shift for deployments relying on TLS certificate validation being deactivated by default. Existing queries without validated certificates may fail and require updates.
Examples
Disable Certificate Validation:
IMPORT INTO Test.DB FROM CSV AT 'https://localhost:8511/' IGNORE CERTIFICATE FILE 'Test.csv';
Provide Public Key for Certificate Validation:
IMPORT INTO Test.DB FROM CSV AT 'https://localhost:8511/' PUBLIC KEY 'sha256//<key>' FILE 'Test.csv';
Changed behavior
Previous Behavior
Default Setting: TLS certificate validation was deactivated by default for external file connections (HTTPS, FTPS) in IMPORT and EXPORT queries.
Action Required: Users had to manually activate certificate validation via database parameters (-etlCheckCertsDefault=1) or SQL syntax (VERIFY CERTIFICATE) to secure connections.
New Behavior
Default Setting: TLS certificate validation is now activated by default for external file connections like HTTPS and FTPS across all IMPORT and EXPORT queries.
Action Required: Users had to manually deactivate certificate validation via database parameters (-etlCheckCertsDefault=0) or SQL syntax (IGNORE CERTIFICATE).
Error Handling: Connections without valid TLS certificates will fail with errors such as:
SSL certificate problem: unable to get local issuer certificate
Public Key Priority: Providing a public key via SQL syntax (PUBLIC KEY 'sha256//<key>') will override other certificate validation settings and enable explicit validation.
