Are client certificates a secure way of having publicly facing SQL database?

Question

Quick Context: I often come across videos where people build apps using SQL database services alongside serverless functions (like AWS Lambda, Vercel, and others) without setting up a VPC to keep the database in a private subnet. Its understable, since putting a Lambda function inside a VPC is that it loses internet access unless you configure a NAT instance or NAT Gateway, since Lambda functions in a VPC can’t have public IPs.

For my use cases, I’m not dealing with ultra-sensitive data — but I still don’t want to leave things wide open for attacks (Because of that, I chose to go with DynamoDB instead.). But I’m trying to better understand the risks and downsides of using databases with public IPs.

Having database in private subnet appears to be a necessary precaution given this deepseek example (and for this as well), even though many developers tend to avoid it. The extra security layer I’ve come across for protecting a public-facing database is the use of client certificates. But that leads to an important question: Is this method secure enough? Or is having a publicly reachable database still a relevant security problem even with this authentication method?

Answer 1

The security of certificate based authentication (as in your case) mainly depends on the protection of the private key for the certificate, i.e. that it should be kept private. There are different ways to protect the private key with different security properties - like having the key plain on the client system, have it password protected, have it protected by hardware like in a smartcard etc.

Of course, the security also depends on proper implementation and configuration of certificate based authentication, including that is a properly verified that only the expected certificate is used (instead of accepting various others too), ideally that it is checked that the certificate was not revoked (include a proper certificate managment which will revoke compromised certificates) and of course that there is no alternative way to access the database without the certificate.

Is this (kind of) secure? Yes, better than simply password based authentication.

Is this secure enough with your specific (unknown) way to protect the private key and your specific (unknown) security requirements and your specific (unknown) implementation and configuration of authentication? This is unknown.

In any case: if the database does not need to be publicly reachable it should not be configured this way. If it will only be accessed from specific networks, then access should be restricted to these. Certificate based authentication is not a replacement for network based access control, instead these should be seen as different aspects of access control and can also be used together.

Answer 2

Like in your previous question, you're conflating two separate concerns. How much you expose the database system and which authentication method you choose are orthogonal problems. For less critical data, it can be perfectly fine to have a database system accessible over the Internet with password authentication only. On the other hand, for particularly critical data, it may be appropriate to use strong authentication with client certificates and keep the database system away from any public network.

Making a database system accessible to an application is always a risk, and it's up to you (or whoever is responsible for the project) to determine the importance of the data and the resulting security requirements. Note this is not only a matter of how much you expose the database system and which authentication method you choose. For example, even if the system is completely hidden in a private network and protected with very strong authentication, an attacker may still be able to issue arbitrary queries through an SQL injection. So it's generally a good idea to have multiple layers of security instead of relying on one aspect only (like client authentication).

• Depending on how critical the data is, make the database system publicly accessible, implement basic network-level access control (like IP checks) or restrict the system to a private network, forcing external clients to connect through a VPN gateway.
• Choose an appropriate authentication mechanism. Password authentication can be perfectly fine as long as you generate the passwords randomly, only transmit them over TLS and store them securely on the client system. If you believe client certificates are more suitable in your case, go ahead.
• Use different database roles for different purposes and restrict their permissions as much as possible. For example, a normal user shouldn't be able to view or change arbitrary data, even if they've found a way to issue raw queries (e.g., through an SQL injection).
• It's crucial for application developers to prevent SQL injection vulnerabilities using prepared statements, escaping or whitelisting.
• Keep all software up-to-date. The best protection may be pointless if it can be bypassed with a vulnerability.