Add secure option for "Build an App"

[dianasaur323]

Current "Build a Test App" tutorial assumes insecure clusters. Add in an option for secure clusters.

conn = psycopg2.connect(database='bank',user='maxroach',host='localhost',port=26257, sslmode='require', sslrootcert='certs/ca.cert', sslcert='certs/maxroach.cert', sslkey='certs/maxroach.key')

[mberhault]

There are a few steps here, for each example:

• determine how the listed library accepts certs/keys. parameter names, file formats etc..
• when file formats differ, document how to convert our certs/keys to the expected format
• consider having the cockroach cert tools generate other formats.

[knz]

A user shared a working node.js example on the forum: https://forum.cockroachlabs.com/t/basic-example-in-secure-mode/1339/6?u=knz

[jseldess]

From #2089:

Here is a quick secure example for PHP if needed.

Current insecure example:

$dbh = new PDO('pgsql:host=localhost;port=26257;dbname=bank;sslmode=disable',
    'maxroach', null, array(
      PDO::ATTR_ERRMODE          => PDO::ERRMODE_EXCEPTION,
      PDO::ATTR_EMULATE_PREPARES => true,
  ));

Secure example:

$dbh = new PDO('pgsql:localhost=host;port=26257;dbname=bank;sslmode=require;sslcert=[path]/client.maxroach.crt;sslkey=[path]/client.maxroach.key;sslrootcert=[path]/ca.crt;',
    'maxroach', null, array(
      PDO::ATTR_ERRMODE          => PDO::ERRMODE_EXCEPTION,
      PDO::ATTR_EMULATE_PREPARES => true,
  ));

[jseldess]

See Java post on forum: See https://forum.cockroachlabs.com/t/connecting-to-an-ssl-secure-server-using-jdbc-java-and-client-certificate-authentication/400

[mberhault]

Ping on this: java is particularly tricky and could use an example. See cockroachdb/cockroach#24487

[jseldess]

Thanks, @mberhault. @awoods187, let's talk about prioritizing this as a docs/eng project for 2.1, perhaps focusing just on jdbc and hibernate.

[jseldess]

For 2.1, part of #2943.

[tim-o]

As part of this document, suggest we provide a link to an overview of certificates & how SSL works. My sense is that this is in part a user education effort.

[rmloveland]

@jseldess I'd like to close this since #2943 is closed. What do you think?

(As noted elsewhere, additional work on the last remaining languages will happen via #3700 )