Database Migration Service 与源数据库建立的每种连接都可以配置为使用安全套接字层/传输安全层 (SSL/TLS) 加密。本页面简要介绍了可用的 SSL/TLS 加密变体，以及将其用于迁移作业所需的步骤。
SSL/TLS 主要适用于通过公共网络建立的连接，在这种情况下，您需要为数据库公开公共 IP 地址和端口。无论您使用哪种网络连接方法，您的场景都可能需要您使用额外的加密。
目标数据库连接始终由 Database Migration Service 加密。您无需为这些连接配置其他证书。
如需了解 Database Migration Service 如何使用 SSL/TLS 加密，请务必注意，在
网络连接方面，Database Migration Service 被视为客户端，而您的数据库（源数据库或目标数据库）是服务器。Database Migration Service 支持以下加密变体：
无
当 Database Migration Service 与您的数据库建立连接时，不会发送任何 SSL 配置字符串。它不会向服务器提供任何客户端证书，也不会验证任何服务器证书。
TLS
当 Database Migration Service 连接到您的数据库时，它会声明该连接是通过安全通道建立的。Database Migration Service 不会向服务器提供客户端证书，但会验证服务器证书授权机构 (CA)，以确保其连接到了正确的主机。
这样可以防止中间人攻击。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Use SSL/TLS certificates to encrypt network connections\n\nEvery connection Database Migration Service makes to your source database\ncan be configured to use Secure Socket Layer/Transport Security Layer (SSL/TLS) encryption.\nThis page provides an overview of available SSL/TLS encryption variants and the steps\nrequired to use them for your migration job.\n\nSSL/TLS is mainly recommended for connections created over public\nnetworks where you need to expose a public IP address and port for your database.\nRegardless of which network connectivity method you use, your scenario might\nrequire that you use additional encryption.\n\nDestination database connections are always encrypted by Database Migration Service.\nYou don't need to configure additional certificates for those connections.\n\nTo understand how Database Migration Service uses SSL/TLS encryption, it's important to\nremember that with regards to\n[network connectivity](/database-migration/docs/oracle-to-postgresql/networking-overview), Database Migration Service is considered the\n**client** and your database (either source or destination database) is the\n**server**. Database Migration Service supports the following encryption variants:\n\nNone\n: When Database Migration Service establishes a connection with your database,\n it doesn't send any SSL configuration string. It doesn't present any client\n certificates to the server, and it also doesn't verify any server certificates.\n\nTLS\n\n: When Database Migration Service connects to your database, it declares that the\n connection is established over a secured channel. Database Migration Service doesn't\n present a client certificate to the server, but it does validate the server\n certificate authority (CA) to make sure that it's connecting to the right host.\n This prevents person-in-the-middle attacks.\n\n To use TLS authentication, you must provide the x509 PEM-encoded\n certificate of the certificate authority (CA) that signed your database\n server certificate.\n\nWhat's next\n-----------\n\n- Learn about encrypting source database connections. See\n [Configure encryption for source database connections](/database-migration/docs/oracle-to-postgresql/encrypt-source-connections).\n\n- To get a complete, step-by-step migration walkthrough, see\n [Oracle to AlloyDB for PostgreSQL migration guide](/database-migration/docs/oracle-to-postgresql/guide)."]]
