Database handlers connect to backend servers via SSL

[izgeri]

Overview

GIVEN I connect to pg or MySQL via Secretless over TCP or Unix socket
THEN Secretless connects with the pg or MySQL backend by sending an an SSL request before sending the handshake response packet (for MySQL, as described in the MySQL protocol docs)

As part of this update, the disclaimer on the pg/MySQL handler pages on the website should be removed.

Story Breakdown

• Parent of A plan exists for updating the database handlers to use SSL for the backend connections #460 - A plan exists for updating the database handlers to use SSL for the backend connections

• Parent of Postgres Handler supports TLS defaulting to sslmode=require #533 - Postgres Handler supports TLS defaulting to sslmode=require

• Parent of MySQL Handler supports TLS defaulting to sslmode=require #534 - MySQL Handler supports TLS defaulting to sslmode=require

• Parent of Modify demos to accommodate default TLS requirements for database handlers #543 - Modify demos to accommodate default TLS requirements for database handlers

• Parent of MySql docs explain TLS options clearly #538 - MySql docs explain TLS options clearly

• Parent of Postgres docs explain all TLS options clearly #537 - Postgres docs explain all TLS options clearly

• Parent of Mysql handler supports sslrootcert and sslmode up to verify-ca #536 - Mysql handler supports sslrootcert and sslmode up to verify-ca

• Parent of Postgres handler supports sslrootcert and sslmode up to verify-ca #535 - Postgres handler supports sslrootcert and sslmode up to verify-ca

Planned future work:

• PostgreSQL and MySQL connectors support sslmode=verify-full #548 - pg / mysql handler supports sslmode=verify-full
• Database handlers support private-key pair as sslkey and sslcert #549 - pg / mysql handler supports private-key pair as sslkey and sslcert

Plan

Downstream TLS Support for Database Handlers