Missing Tls in Actix with Cockroachdb

When an Actix web service connects to a CockroachDB cluster without TLS, credentials and query data traverse the network in plaintext. In a typical setup, the Actix application uses a database connection string or a configuration that omits sslmode=require (or equivalent). Because middleBrick scans the API surface without authentication, it can detect unencrypted database endpoints and flag the absence of transport-layer encryption as a data exposure finding. An attacker who can observe or intercept traffic between the Actix service and CockroachDB can read connection parameters, session information, and potentially modify queries in transit.

The risk is compounded in distributed environments where Actix instances and CockroachDB nodes communicate across internal networks that are assumed to be trusted. Without TLS, there is no server identity verification, making the system vulnerable to man-in-the-middle attacks even within private networks. middleBrick’s encryption checks highlight this by identifying connections that do not enforce encrypted communication, providing remediation guidance to enable TLS and validate certificates. This combination is particularly sensitive because database transactions often contain personally identifiable information or business-critical data, and missing encryption directly conflicts with compliance frameworks such as PCI-DSS and GDPR.

To secure the Actix and CockroachDB integration, enable TLS for the database client and verify server certificates. Use the postgres feature flags supported by the Rust driver to enforce encrypted connections and present client certificates when required. The following example shows a secure Actix configuration using the sqlx crate with a CockroachDB connection string that enforces TLS mode verify-full, providing both server authentication and optional client authentication.

use sqlx::postgres::PgConnectOptions;
use sqlx::ConnectOptions;
use std::time::Duration;

let mut opts = PgConnectOptions::new()
    .host(&std::env::var("DB_HOST").unwrap_or_else(|_| "localhost".into()))
    .port(26257)
    .database(&std::env::var("DB_NAME").unwrap_or_else(|_| "defaultdb".into()))
    .username(&std::env::var("DB_USER").unwrap_or_else(|_| "root".into()))
    .password(&std::env::var("DB_PASSWORD").unwrap_or_else(|_| "".into()));

// Enforce TLS with server certificate verification
opts = opts.tls_mode(sqlx::postgres::tls::Mode::VerifyFull);

// Optional: provide a custom TLS connector with root certificates
/*
use native_tls::TlsConnector;
use sqlx::postgres::tls::native_tls::NativeTlsConnector;
let tls = NativeTlsConnector::new(TlsConnector::new().unwrap());
opts = opts.tls_connector(Box::new(tls));
*/

let pool = sqlx::PgPoolOptions::new()
    .max_connections(5)
    .connect_with(opts)
    .await
    .expect("Failed to connect to CockroachDB with TLS");

If your CockroachDB cluster uses client certificate authentication, configure the TLS connector to include the client certificate and key. The following snippet demonstrates how to add client certificates with native-tls, ensuring that the Actix service can mutually authenticate with the database.

use sqlx::postgres::tls::native_tls::NativeTlsConnector;
use native_tls::{TlsConnector, Identity};
use std::fs;

let certs = fs::read("/path/to/client.crt").expect("unable to read client cert");
let key = fs::read("/path/to/client.key").expect("unable to read client key");
let identity = Identity::from_pkcs8(&certs, &key).expect("invalid identity");
let tls_connector = TlsConnector::builder().identity(identity).build().expect("TLS builder failed");
let tls = NativeTlsConnector::new(tls_connector);

let pool = sqlx::PgPoolOptions::new()
    .max_connections(5)
    .connect_with(
        PgConnectOptions::new()
            .host("your-cockroachdb.example.com")
            .port(26257)
            .database("defaultdb")
            .username("root")
            .password("securepassword")
            .tls_connector(Box::new(tls)),
    )
    .await
    .expect("Failed to connect with client certificates");

For non-Acme or locally managed certificates, you can use rustls to provide a custom root certificate store, which is useful in air-gapped environments. This approach ensures that the Actix application validates the CockroachDB server certificate against a pinned CA, preventing accidental cleartext communication and aligning the deployment with security best practices.