@Rocky I have starrocks 4.1.4 deployed in AWS Now mysql endpoint only support http not https right so we can't connect safly from internet so what's best way? is there anyway we can enable https?

Since you are on StarRocks 4.1.4, you definitely have support for secure connections (SSL/TLS) for both the MySQL protocol and the HTTP/REST interface. The term "HTTPS" usually refers to the web/REST interface (port 8030), while "SSL/TLS" is used for the MySQL endpoint (port 9030). Here is how you can enable them: 1. Enable SSL for the MySQL Endpoint (Port 9030) StarRocks supports SSL for MySQL connections since v3.4.1. To enable it, configure these parameters in your `fe.conf`: *

ssl_keystore_location

: Path to your Java Keystore (JKS) file containing the certificate and key. *

ssl_keystore_password

: Password for the keystore file. *

ssl_key_password

: Password for the private key inside the keystore. *

ssl_force_secure_transport

: Set to

TRUE

if you want to reject any non-encrypted connections. Example:

properties
ssl_keystore_location = /path/to/starrocks.jks
ssl_keystore_password = your_password
ssl_key_password = your_password
ssl_force_secure_transport = TRUE

2. Enable HTTPS for the Web/REST Interface (Port 8030) From v4.0 onwards, StarRocks supports native HTTPS on the FE. By default, it uses port 8443. *

enable_https

: Set to

true

in

fe.conf

. *

https_port

: Default is

8443

(you can change this if needed). * The FE typically reuses the same keystore configured for MySQL SSL. 3. Best Practices for AWS Deployment While enabling SSL/TLS on the database itself is good, exposing a database port (9030) directly to the internet is generally not recommended. The "best way" to connect safely in AWS involves several layers: 1. AWS Network Load Balancer (NLB) with SSL Termination: * Instead of connecting to the FE directly, put an NLB in front of your FE nodes. * You can attach an AWS Certificate Manager (ACM) certificate to the NLB to handle encryption. 2. AWS Client VPN or Site-to-Site VPN: * Keep StarRocks in a private subnet. * Connect via a VPN so that your traffic never touches the public internet. 3. VPC Peering or PrivateLink: * If your client is also in AWS (but a different VPC), use VPC Peering or PrivateLink for private, secure routing. 4. Security Groups: * Always restrict access in your Security Group to specific source IP addresses rather than allowing

0.0.0.0/0

. Summary * Can you enable HTTPS/SSL? Yes, it is fully supported in your version. * Is it safe? SSL/TLS makes the data transfer safe, but direct internet exposure is still a security risk. Use an AWS NLB or VPN for the best balance of security and usability. References • administration/management/BE_configuration.md • administration/user_privs/ssl_authentication.md • administration/management/FE_configuration.md